The zero-trust strategy approaches security from the mindset that no one — not even your internal network users — can or should be trusted automatically. Here’s why zero trust security is picking up traction with organizations and governments globally…
… It’s not paranoia when someone really is out to get you. And if you’re an organization or business, you can virtually guarantee that someone, somewhere has you in their crosshairs. Verizon reports 82% of data breaches involve the “human element” — including everything from phishing and social attacks to general errors and misuse — so, it’s clear why all organizations need to change how they approach cyber security.
This is why the U.S. Department of Defense published information regarding plans to shift its network to a “zero trust architecture” by 2027. In its Zero Trust Strategy and Roadmap document, the federal defense agency shared its goals about what it aims to achieve and what its vision is for the future: implementing stronger defenses against cyber attacks via a dynamic and adaptive approach (zero trust).
This move toward zero trust security has been picking up traction with businesses and other organizations globally over the past several years. It contrasts the traditional notion that cyber security efforts should focus on external threats and hardening your perimeter defenses to protect against threats outside your network. Imagine the cyber security incidents (and resulting data breaches) that could have been avoided if the targeted organizations had implemented zero trust:
But what is zero trust and why is it something that can benefit organizations and businesses across all sectors (not just the DoD)?
Let’s hash it out.
Zero trust is an organization’s answer to the childhood warning “stranger danger!” It’s both a framework and strategy that operates with the understanding that no one — not you, your devices, your apps, or even your CEO — can (or should) be trusted automatically. And it’s nothing personal — it’s not because your IT admin doesn’t like you. This real-time security strategy approaches cyber security from the perspective that everyone inside and outside your network is a potential threat.
Zero trust touches everything relating to your IT ecosystem and everything that goes on in the background. It promotes the idea that there are no traditional network boundaries; your assets and resources can be anywhere — on prem, in the cloud, or a mix of both. This makes it a versatile approach to hardening your cyber defenses. Therefore, everyone with access to your organization’s network or IT resources must have their identities continuously vetted throughout their connections.
Regardless of where your assets are that you want to secure, there are three guiding principles at the heart of zero trust security:
1. Never Trust, Always Verify
What we mean by this is that users need to authenticate in a verifiable name. Simply taking them at their word just won’t cut it. This entails using setting default-deny policies, setting least access privileges, and using public key infrastructure (PKI) based tools (such as client authentication certificates).
Whenever someone logs in or tries to access something in a zero trust environment, they’ll need to continually authenticate (prove their identity) throughout the session. Why? Because session IDs can be hijacked and someone unintended can take over a connection. By implementing comprehensive identity and access management, you’re reducing the potential harm an account compromise could cause.
Manage Digital Certificates like a Boss
14 Certificate Management Best Practices to keep your organization running, secure and fully-compliant.
2. Assume a Hostile Environment or That a Breach Has Occurred
With zero trust, you assume the worst (someone bad is already in your network) but hope for the best. You’ll want to assume that every network connection and access request is from an attacker. This involves monitoring all users, devices, connections, requests, and configuration changes continuously to ensure that no one is accessing something they shouldn’t.
3. Verify Explicitly
Verify that users are accessing things securely. Have security mechanisms in place to ensure they’re doing that. This includes enforcing policies dynamically via the policy engine and policy administrator (PE determines whether access is approved or denied and the PA executes that decision). And, as always, monitor and log all access requests and traffic.
Image caption: This graphic represents a basic overview of the foundational concepts behind zero trust: trust nothing and no one, have security mechanisms in place for identity and device verification, and assume all traffic (both inside and outside the network) is an attack.
There’s No One-Size-Fits-All Approach to Zero Trust
There are different approaches to zero trust put out by different organizations and different standards as well. Probably the most commonly known zero trust framework is the National Institute of Standards and Technology’s (NIST) special publication: NIST SP 800-207 — Zero Trust Architecture. This document laid the groundwork for other frameworks from agencies such as the U.S. Department of Defense and the National Security Agency (NSA).
These other frameworks have a lot to offer information of information and applications. (The DoD guidelines, in particular, offer more breadth and depth than the NSA’s.) And we’ll touch on key concepts from these resources throughout the article.
Why Zero Trust Matters: Looking Beyond the Surface to Secure Your Digital Assets
We live in a time when you can no longer take things at face value. You can’t simply assume that someone is who they claim to be simply because they type in a username and password; all it takes is a small third-party data breach for someone’s password to become known to the dark web. And if that person uses that same password to secure multiple accounts, then attackers can use it to brute force their way into their accounts.
This is why it’s crucial that we look much deeper and look at other verifiable and contextual information. This approach helps us determine whether someone requesting access to sensitive resources is authentic and has the authorization to access those assets.
Discussing this topic of zero trust always makes me think of scenes from the Mission: Impossible movie franchise. In several movies, Tom Cruise’s character, Ethan Hunt, wears masks and contact lenses to impersonate key characters. Sure, on the surface, he looks like each of the people he’s pretending to be. He can even use a voice modulator of some kind to sound like each person he’s impersonating. But just because he looks and sounds like that person doesn’t mean Ethan Hunt (Cruise) really is them.
Now, let’s leave Hollywood behind for a second and imagine if someone who looks and sounds like your boss or CEO walks into your building. You’d likely assume that it’s him or her. That would be pretty hard to fake, right? Heck, if I saw someone walk in who looked and spoke like our CEO, Bill Grueninger, I’d likely assume it’s really him, too. But if I walked up and started tugging on his face to see if it’s a latex mask or is the real deal, I’d likely find myself landing a really uncomfortable meeting with HR.
In a digital environment where users authenticate remotely, though, you need to have a way to verify their identities are legitimate. It makes you wonder what major cyber security incidents and data breaches may well have been avoided if the targeted organizations adopted zero trust policies and processes…
A zero-trust environment differs from a traditional security approach in that zero trust means you have continuously prove your trustworthiness, whereas a traditional environment means that once you’re inside the network, you’re automatically assumed to be safe.
Image caption: A set of illustrations that show the difference between a traditional trust-based network and a zero trust network.
Unfortunately, the traditional model no longer works in a world of credential phishing and session hijacking. You need more robust security and authentication measures in place.
If you search online, you’ll notice that different organizations approach zero trust in different ways. For the sake of this article, we’ll talk about the seven pillars of zero trust in terms of how the U.S. Department of Defense framework defines them. The seven zero trust pillars we outline below are overarching categories of focus for implementing zero trust. Each pillar involves monitoring and logging but also entails other specific protections.
Image source: A diagram we created based on the U.S. Department of Defense’s seven zero trust pillars with the addition of CA and PKI-based digital identity.
Users — Controlling access to protected resources by continuously authenticating users using digital identity components (such as client authentication certificates) and verifying users’ access authorizations.
Devices — Use device digital identity (think TPMs, device certificates, etc.) to authenticate access in real time. Devices also must be patched to mitigate vulnerabilities.
Network/Environment — Segmentation, isolation, and policy restrictions are three critical components to control access and manage how data moves on your network. This approach helps to restrict access and prevent lateral movement within the network.
Applications and Workloads — Whether you’re using resources that are on-prem, cloud, or a hybrid approach, the idea here is to secure the application layer.
Data —Secure your data by developing a comprehensive data management strategy and integrating data security measures such as at-rest and in-transit data encryption. This will help protect your data both while it’s on your servers or moving between two endpoints.
Visibility and Analytics — Having full visibility of your IT environment is crucial to keeping it secure. You can’t protect assets you don’t know exist, and you can’t stop attackers when you don’t realize something is wrong. You can gain actionable insights to improve your cyber security by analyzing your network’s traffic and user behaviors in real time to identify threats. Just be sure to consider that some traffic may contain sensitive data, so decide the best approach (such as informing users and obtaining their consent ahead of time).
Automation and Orchestration — Automation is a scalable approach that takes monotonous tasks off your team’s plates, freeing them up to focus on tasks that require critical thought processes. These tools also enable you to quickly sort through all the noise your security tools generate to find valuable data.
Zero trust as a cyber security approach has gained strong support over the last several years. This is partly because of the use of identity-based authentication and user authorization that’s required. In a nutshell, here’s a quick overview of how access controls and management play together to boost your organization’s cyber security:
Access controls are the rules, settings, and tools you use to control access to sensitive data and resources.
Access management is the process of setting up and managing who has authorization to access specific resources and systems.
Of course, neither of these things is foolproof and requires another security layer in the form of authentication. User and device authentication are all about ensuring that only entities (i.e., those whose digital identities have been verified and their authorizations confirmed) can access your secure digital assets.
A key element of the zero trust approach is a concept known as continuous authentication. The idea behind continuous authentication is that all network users, including your employees, must not only prove their identities when they first log in but also continuously prove their identities throughout their sessions.
Why is this necessary? Because session IDs can be set to last for extended periods — anywhere from a few hours to even a few weeks. This means that if a cybercriminal steals an authenticated user’s access tokens (session IDs and cookies), they can pretend to be them and access whatever protected resources their account has the authorization to access.
While some platforms have mechanisms to prevent authentication from happening, this may not always be the case. And it’s true that you can set timeout limits to take effect after certain periods, but if you don’t bother setting up these security limits, then it’s inevitable that at least one bad guy might slip through the cracks.
For zero trust security to work, you need to have a way to prove that you’re really you and aren’t an imposter who’s trying to fraudulently access sensitive data, systems, and other resources. The way to achieve this level of reliable and verifiable digital identity is through the use of public key infrastructure (PKI) and digital certificates. (We’ve talked a lot about these concepts before, but we’ll talk more about them again a little later in the article.)
Digital certificates are small data files that pack massive punches. They contain verified identifying information about you and/or your organization that a trusted authority (certificate authority) attests is authentic.
You can think of digital certificates in much the same way as an official passport: that little government-issued booklet contains verified information about you that proves your identity to people you’ve never met. This way, you can show your passport to airport security and other authorities (i.e., people who don’t know you) to prove you’re really you. (Sorry, there were a lot of “yous” in that paragraph.)
What do digital certificates and continuous authentication have to do with one another? Everything, really.
In a zero-trust environment, there are no implicitly or explicitly trusted users, devices, or zones within your network or IT environment. The digital identities of everything and everyone must be authenticated continuously using verifiable methods — period. And digital certificates are a means of doing precisely that.
Digital certificates enable trusted third parties to attest to your digital identity’s authenticity. It’s kind of the digital equivalent of how the U.S. Department of State attests to an American’s identity each time it issues a passport.
In a zero-trust environment, each employee, device, or other network user must have a way to mutually authenticate in a way that’s verifiable. How? By using a security mechanism that the security of the internet itself is built upon: public key infrastructure (PKI).
Public key infrastructure is the combination of rules, processes and technologies that enable two parties to communicate securely. Without PKI, if you were trying to connect to your bank’s website, it would be risky: you wouldn’t have a way to securely send your data because you wouldn’t know for sure who was on the other end of the connection. Even if the connection is encrypted, if you’re connecting to a cybercriminal, they’d have the decryption key to unscramble your data and read it.
Remember the DoD Zero Trust initiative that we mentioned earlier? Its DoD Zero Trust Architecture document shares one of the most beautiful lines we could hope to read in a government resource as an explanation: “The use of mutual authentication of users with PKI-based client authentication or mutual authentication certificates to web applications has long been the effective standard.”
Darned right, it is. And that’s because PKI isn’t the new kid on the block; it’s been around the block many times since its inception in the mid-1980s. PKI has served as the trusted foundation of internet security since that time because it’s what enables secure remote communications and data transmissions that, otherwise, would be impossible.
When it comes to remote user authentication and access, looking beneath the surface is a necessity. You can’t simply see that someone logs in using a basic username-password combination and assume it’s the legitimate account owner; you need an additional layer of verification that continually proves it’s the authentic user. Adopting a zero-trust approach can help in several ways:
Implementing zero trust is a way to prevent cybercriminals from taking advantage of vulnerable access tokens (session cookies, IDs, or weak credentials) to gain access to sensitive resources while pretending to be legitimate network users. Yup, that’s right — if even one of your employees who has privileged access uses a weak password for their account, it could be game over for your business. All it takes is one bad enough “oops” to cause you to face immense penalties, lawsuits, or even have to close your doors forever.
Incorporating zero trust into your cybersecurity strategy is also a great way to help protect your organization’s reputation, brand, and bottom line. Okta’s 2021 State of Digital Trust report shows that 75% of American consumers say they likely won’t do business with brands they don’t trust (i.e., after a data breach or misuse of data). Almost half, a whopping 47%, say they’d take things a step further and would permanently stop using a company’s services for the same reasons.
Imagine what would happen if an unauthorized user gained access to your most sensitive data. This could be your intellectual property (IP), customers’ financial data, or even employees’ records. Regardless of which type of data they get their slimy paws on, exposing sensitive data would spell disaster for your organization.
In addition to the no-brainer reason of you don’t want your information accessed by unauthorized individuals, there are also other concerns that adopting zero trust could help you avoid
Non-compliance issues with regard to industry standards,
Data breaches that can lead to hefty fines, penalties, and lawsuits,
Your reputation taking a big hit, and
Customers not trusting you or your services.
We’ve seen this type of scenario happen time and again in various data breaches. Here’s a quick example of what could happen without a continuous authentication mechanism in place:
An attacker phishes one of your company’s key employees, tricking or manipulating them into coughing up their privileged access credentials or session ID. This may not be hard considering that IBM’s X-Force Threat Intelligence reports phishing as the attack vector in two in five incidents their team responded to.
The attacker uses their login info or session ID to access secure resources using that employee’s account. Once in, they’re able to move laterally across the company’s network — accessing applications, databases, and other resources that the employee’s compromised account has access to — pillaging as they go.
Once they find interesting and valuable data, the attacker exfiltrates whatever data they can to an external server they control before installing malware onto your systems. It’s a devastating one-two punch you never saw coming that can bring your company to its knees.
Image caption: A diagram that illustrates the basic concept of how an attacker can exploit compromised credentials in a non-zero trust environment.
Because your organization didn’t require continuous authentication (i.e., didn’t implement zero trust) or have restricted policies in place that are enforced, your IT security admin or cyber security team doesn’t realize that anything is amiss until it’s too late. Now, you’re not only dealing with a data breach, you’re also scrambling to deal with the ransomware situation as well.
But wouldn’t a firewall be able to tip off your cyber defenders that something’s wrong? Sure, event logs will show a significant increase in traffic. But since the traffic appears to be legitimate (because the attacker is using the employee’s legitimate credentials, may be using a proxy IP address to disguise their true location, and you’re not analyzing device identity attributes or behaviors), they may not initially realize that it’s actually an external attacker and not your legitimate employee accessing your systems until the damage has already been done.
Oh boy. We hope you have business continuity, disaster response and disaster recovery plans in place, and that those plans are not only current but that your employees know what their roles and responsibilities are! Cyber resilience is crucial; but without the right security mechanisms, strategies and plans in place, you may not like the outcome.
Insider Threats in Action: A Real-World Look at the Elliott Greenleaf Breach (2021)
Attackers are becoming increasingly sophisticated and potential attack surfaces are expanding. As such, our defense of these systems must become more robust and dynamic. To go beyond discussing zero trust from a largely conceptual standpoint, let’s dive deeper and explore the damage caused to a real-world organization by bad actors within its trusted internal network.
What Happened
In January 2021, the Pennsylvania law firm Elliott Greenleaf was the victim of an insider attack and sustained catastrophic financial losses, according to WestLaw.com. According to multiple reports, four attorneys and a paralegal secretly downloaded a slew of invaluable sensitive data, including confidential files, trade secrets, and client lists. Their actions as insider threats resulted in irreparable damages to their former employer, which has since filed a lawsuit against the four attorneys and the paralegal.
“The threat that an insider will use her/his authorized access, wittingly or unwittingly, to do harm to the security of organizational operations and assets, individuals, other organizations, and the Nation. This threat can include damage through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of organizational resources or capabilities.”
As it turns out, these legal professionals, who were trusted to operate internal systems (seemingly with little to no oversight), were wolves in sheep’s clothing. They were joining a rival law firm in Delaware (Armstrong Teasdale) and, it appears, wanted to take Elliott Greenleaf’s info with them.
Unfortunately, this isn’t an uncommon scenario; Code42’s research shows that there’s a one in three chance an organization will lose intellectual property when one of its employees quits.
How It Happened
Let’s quickly break down what occurred that enabled these insiders to wreak havoc based on information shared by Digital Guardian and WestLaw:
The attorneys had immense access to files and data. The attackers had access to read, steal, and destroy highly sensitive information. For example, they reportedly shredded 288 lbs of physical documents. (That’s approximately 28,800 pieces of paper if you’re using standard copy paper). In some cases, they enlisted the help of the paralegal to get certain data for them.
They accessed systems that appear to lack monitoring and/or alerts. To steal data, they were able to use one or more personal USB devices and had cloud-based file-sharing apps installed on their company devices.
They were able to send and delete emails containing sensitive information without detection. As such, they could send additional sensitive information to personal email accounts — and subsequently “double-delete” the messages in an attempt to cover their trails. Granted, the company says it’s able to access the delete emails via their data backup systems, but by that time, the damage had already been done.
The Big Takeaway From the Elliott Greenleaf Law Firm Situation
Unfortunately, the Elliott Greenleaf law firmed learned a valuable lesson the hard way: This catastrophe likely could have been prevented (or identifier earlier) if Elliott Greenleaf had adopted a zero trust approach. With zero trust:
the employees’ access should have been continuously verified across all systems,
their reach (i.e., their permissions and breadth of access) should have been restricted to only what they needed to do their jobs (think policy of least privilege), and
their access to resources and use of USB devices should have been disabled — or, at the very least, monitored, logged, and analyzed.
It’s our hope that you that you keep this story in mind and recognize that the threat from within your organization can be as, if not more, dangerous than outside attackers. Although the damage caused by this insider breach is irreversible, future attacks of this nature can be prevented through by adopting a zero trust posture.
Now, we’re not going to get into the nitty-gritty of how to actually implement zero trust. There’s far too much information that would need to be covered that it would, basically, entail creating a whole other article. However, NIST (SP 800-207) and the DoD (DoD Zero Trust Reference Architecture) provide some guidance for federal agencies on how to build zero trust architectures (from the ground up or migrate their systems to zero trust over time). Some of this information may be useful to your organization as well.
Adopting a Zero Trust Strategy Is One of the Best Ways to Secure Your Organization
Zero trust isn’t totally new, and it certainly isn’t going anywhere anytime soon. It’s gaining traction over time. Okta reports that 55% of surveyed organizations globally indicate that they have a zero trust initiative in place. A whopping 85% of global 2000 (G2000) companies said they’d allocated “moderate” or “significant” year-over-year increases in budgets to fund these initiatives.
Of course, there is still room for improvement. Research from Forrester and Illumio shows that only 6% of organizations indicate that they have fully deployed zero trust within their IT environments. But, hey, it’s a start, right?
One of the key attributes of zero trust is limiting who has access to what. This involves setting and enforcing policies, using verifiable digital identity, following the least privilege principle, monitoring all access attempts and behaviors, etc. By limiting a user’s reach to only the resources and systems they need to do their jobs, you reduce your attack surface. So, rather than having cybercriminals have access to everything, they can only access the systems and data that the user is authorized to access.
In a zero-trust environment, a bad guy will first have to go through a series of verification checks to ensure they’re the authentic user. If they fail that, then they won’t get access to anything. If they succeed, then at least their reach will be restricted to the privileges you’ve assigned the compromised user’s profile. And since you’re keeping an eye on everything and are logging everything for analysis, it’ll help you better mitigate these issues in the future.
Why are organizations turning to software-defined wide area networks? Explore why organizations should consider adopting an SD-WAN approach to revamp their digital networks
Editor’s Note: This is a guest blog contribution from Nahla Davies, a software developer and IT/tech writer. Davies explores what a software defined wide area network is, how it’s commonly used, and how you can transition your business to using this connectivity approach.
Increasing your organization’s networking capabilities, security, and bandwidth is necessary to enable corporate growth. This is particularly true for multi-site organizations that increasingly rely on cloud apps, teleconferencing, and video streaming tools. The COVID-19 pandemic has exacerbated these bandwidth concerns; outdated wide area networks (WANs) are incapable of scaling adequately to meet increasing demand, forcing organizations to look for a better solution to support their digital strategies.
It has been possible for individuals and businesses of all sizes to access high-speed Internet connections and critical data thanks to software-defined wide area networks, or SD-WANs. The SD-WAN market, worth $1.4 billion in 2019, is predicted to be worth $43 billion by 2030, according to Prescient & Strategic (P&S) Intelligence research. This means a compound annual growth rate (CAGR) of more than 38% over the forecast period (2020-2030).
But what is an SD-WAN and how could using one benefit your organization?
Let’s hash it out.
What Is a Software-Defined Wide Area Network? SD-WAN Explained
SD-WAN is the abbreviation for “software-defined wide area network.” It’s a way for you to connect your devices, systems and offices globally using multiple network connection methods, alternating between connections based on whatever provides the greatest connectivity in any given moment. The idea behind this flexible approach of distributing (routing) traffic across your network is to help you save money and increase network performance.
SD-WAN is a term that refers to a programmatic and automated way to manage your global enterprise’s network connectivity and circuit expenses through the use of virtual services. This software-based virtual network technology is more relevant than ever before for an increasingly remote workforce. It can assist you in providing your company’s network with reliable connectivity and significantly help tackle internet of things (IoT) security risks to ensure data privacy.
Other features of the SD-WAN include connecting your onsite and offsite resources instantly. SD-WANs use software to manage the connection between remote branches, data centers, and cloud instances.
Need a visual aid to understand these concepts? Check out this video:
A local area network, or LAN, is the traditional network that works within your on-premises office to allow devices locally to connect and communicate with one another in a single, limited area. This differs from a vast wide area network (WAN), which connects devices located in remote offices or branches with applications and other network resources. WANs require a multitude of routers to operate at the locations to enable the branches to communicate — each of which must be managed and have rules created for it by your IT admin.
In general terms, LAN refers to the interconnected devices from within a building, while WAN refers to the interconnected devices from outside of the building. Both of these differ from an SD-WAN, which refers to routing traffic to different remote locations. SD-WAN also improves the hybrid WAN through packet management, bandwidth efficiency, dynamic path optimizations, applications monitoring and improved performance.
SD also makes it a lot easier to separate networks (such as public, private, and IoT networks). Historically, this would be a challenging task because it would require different switches or subnets. But some SD-capable routers can handle this separation fairly easily and quickly.
Image caption: A WAN is a traditional network that’s dependent on hardware devices. SD-WAN is software that’s used to manage the WAN instead of only physical hardware.Image caption: A LAN is a series of devices that can connect to the Internet that link together as one network from a centralized location
Popular Use Cases for SD-WAN
Before implementing an SD-WAN, it is vital to identify and organize your organization’s needs and its role in developing your business strategy. The following use cases represent a set of possible uses of SD-WANs (depending on the particular environment and your specific business goals). Always make sure to ask how SD-WANs can benefit your business and customers.
1. Direct Internet Access (DIA)
Integrated and cloud-based security offers better protection against Internet assaults. Dedicated internet access frees up bandwidth on the WAN while enhancing security and speeding up internet usage for branch employees and visitors. Branch employees and guests can connect locally via DIA, which reduces traffic on your WAN and improves internet speed. As a result, the branch now has a direct connection to the Internet, saving time and money.
Despite being predominantly software-centric, SD-WAN still requires some sort of hardware devices to operate (i.e., SD-WAN routers). However, while traditional WAN requires quite a lot of work and time to handle network operations, SD-WAN can reduce those efforts to a minimum. In fact, several SD-WAN devices offered today on the market such as devices offered by Cisco are plug-and-play (zero-touch provisioning) and brought online without administrative intervention at the branch/remote office.
2. Branch-to-Branch Connectivity
Organizations that need high-throughput, continuous connections from multiple offices have traditionally relied on multiprotocol label switching (MPLS) circuits or virtual private network (VPN) tunnels. MPLS circuits are a telecommunication routing method that transfers data from one node to another by identifying existing pathways between endpoints, while VPNs are designed to encrypt data shared over public networks.
SD-WAN has emerged as a new solution for branch-to-branch connections. It can minimize the burden and cost of managing the connectivity of branch offices with MPLS. SD-WAN simplifies and accelerates the procedure, so no excess time is wasted in standard ways to set up internet breakouts from branch/remote offices is time-consuming and mistake-prone. In contrast to typical networks, SD-WAN solutions do not depend on the traditional hub-and-spoke model, which might cause performance issues.
Existing ways to safeguard all user sites can be slow and error prone. Consider a scenario where dozens of users use a cloud-based service from different locations. SD-WAN can conveniently connect those users into one virtual location using SD-centralized WAN control and automation.
When branches link directly to the data center or cloud, transit time and overhead are reduced, bottlenecks are eliminated, and application performance is improved.
3. Application Performance Optimization
SD-WANs help network administrators define service-level agreements (SLAs) for specific applications by using SD-WAN to craft and enforce their own internal SLAs that match the requirements of the business. Specifically, teams can set parameters for uptime, fix times, and latency. This ensures that traffic is routed efficiently to meet those SLAs while also alleviating congestion, improves application performance, and possibly lowers networking costs. It allows the use of centralized application controls, which automatically direct critical programs around network difficulties
When an SD-WAN is in place, applications no longer need to be re-routed through the central site. SD-WAN enables managers to prioritize mission-critical apps and route traffic via the best transport available. For example, if you need to prioritize voice traffic over email, you can configure SD-WAN devices to prioritize voice packets (think VoIP) over other data. This will contribute to ensuring a smooth call experience.
Moreover, SD-WAN managers can prioritize key applications while deprioritizing less important ones using application-aware quality of service (QoS) capabilities. This can be used to offer precedence to the most critical applications, resulting in faster response times when the apps are managed directly. They can also monitor the SD-WAN environment at a high level to detect faults in real time.
4. Cloud Migration
The superior branch and cloud connectivity, application prioritization, and better visibility into network traffic are all good reasons why it’s worth considering SD-WAN for your cloud-first strategies.
Traditional WANs can only support applications from a central data center. But SD-WANs have been designed to fulfill the most stringent demands of cloud computing. They:
Enable direct cloud access to all applications regardless of where the employee is located physically.
Support application-based routing, allowing every app to use the most appropriate wide-area service per its needs.
Enable all organization’s branches to get direct access to the internet.
On top of this, multi-cloud apps offer visibility and help simplify management.
6 Benefits of Transitioning to SD-WAN
Now that we’ve covered the basics of SD-WAN, let’s look at some of how SD-WAN can help enable digital transformation within your organization.
1. Secure Networks With Comprehensive Data Encryption
Experts aren’t in agreement about the security of SD-WANs. Some say they offer better security; others say they provide weaker security. Security teams would be wise to keep in mind that just because SD-WAN offers encrypted traffic as an initial level of defense, further defenses will be a must. But encryption isn’t everything; because you’re talking about a distributed system, encryption alone won’t cover all security aspects. You need other protections in place as well.
However, there is no industry standard for implementing security into SD-WAN. Several approaches include:
Ensuring PCI DSS Compliance — Always ensure PCI-DSS compliance when transmitting sensitive customer or business financial data. SD-WAN allows you to segregate POS systems and other critical networks so you can isolate the POS system and its transmitted financial information from the rest of the network (better for data security). This is possible thanks to the flexible segmentation and provisioning capabilities that SD-WAN offers.
Enabling encryption — Many SD-WAN tools enable you to use AES-256 encryption to secure traffic by application, so you can protect site-to-site traffic at any of your branch locations.
Using next-generation firewalls — Even though most SD-WAN solutions come equipped with built-in firewalls, they often only include basic security filters such as packet filtering to reduce unauthorized access. However, they lack end-to-end coverage that remote enterprises require. Next-generation firewalls offer more advanced security methods, including deep packet inspection (DPI) and intrusion detection and prevention capabilities.
On that last note, firewalls included in low-cost SD-WAN appliances especially are often no different from those found in routers sold by big-box electronics stores. SD-WAN may have some capabilities that appear to improve cybersecurity, but these technologies aren’t always as robust as they would appear to be. Some SD-WAN suppliers advise you to replace them with a separate cloud-based firewall solution. This will also enable you to implement a centralized policy control for all locations and, when needed, push policy changes to multiple branches in a matter of seconds.
A new trend that complements SD-WAN and security technologies, known as SASE (an acronym for Secure Access Service Edge that was created by Gartner), can help your network be secure. In a nutshell, SASE is a kind of SD-WAN on steroids. It can do everything SD-WAN can do and more. It provides advanced, integrated security features, and it’s deployed in the cloud. Thanks to SASE, organizations can easily implement zero trust security (i.e., no device, user, or system should be trusted by default).
2. Fast and Dependable Connectivity
Enterprise networks usually fail to keep pace with the digital transformation of their consumers. SD-WAN can offer the necessary adjustments. It can help businesses support digital technologies such as voice over IP (VoIP), IoT, and corporate productivity apps.
Companies can use SD-WAN to establish fast and dependable connectivity for next-generation services and bring all their branches, sites, or locations on-net for business applications. They can do all this while also improving their capacity to track and regulate end-user experience at each location.
3. Better Network/Service Availability and Uptime
To succeed in the digital age, your company must first decide whether to implement a digital transformation strategy. However, a seamless failover is just as important if a critical process is dependent on uptime and availability. You might also want to look into application recognition with deep SSL inspection and traffic steering. The advantage of SD-WAN is its capacity to fine-tune and alter connections to assure peak performance.
4. Increased Data Transportation Flexibility
SD-WAN provides flexibility and agility through dynamic resource allocation, application-aware traffic routing, and short lead times for adding capacity and connectivity. Zero-touch provisioning and automatic network administration also simplify and minimize operation and management.
Creating an underlay network using SD-WAN is a lot more flexible than a traditional WAN. Paired with other integrations (such as ADSL, VDSL, and even 4G LTE), there’s virtually no limit to what you can do. This flexibility in transportation will enable branches to be connected more efficiently, regardless of their geographical location or any carrier limitations.
Utilizing the most cost-effective or acceptable bandwidth is possible depending on where a business or site is located.
Thanks to a centralized control base, it intelligently and securely routes traffic across several locations while concurrently adjusting bandwidth where it is most needed. Enterprises can benefit from broadband hauls without having to dismantle everything.
How? You may see an immediate return on investment due to:
Reduced infrastructure costs
Greater efficiency and reliability of cloud-enabled network services
Consolidation with intelligent, flexible, and secure routing
Greater flexibility due to on-premises or cloud-based controllers
Integrated LTE connectivity
In some cases, enterprises may expect a 100% ROI from a fully integrated SD-WAN solution within three years. Some clients can accomplish this in just one year of implementation.
Hence, there’s less need to spend money on more expensive multi-protocol label switching (MPLS) links because direct internet links can handle the need for more bandwidth.
6. Preparation for Future Digital Innovations
SD-WAN becomes one component of the giant digital transformation puzzle in a business setting. Shifting to a software-driven virtual network could pave the way for future digital innovations because digital transformation requires the right mindset and a plan.
Remember P&S’s SD-WAN market size increase to $43 billion (by 2030) mentioned at the beginning of this article? This may be true for a variety of reasons. For starters, modern workplaces increasingly need to simplify their networks and more flexibility and efficiency when it comes to deploying cloud-based solutions.
If your company relies on a traditional WAN, you’ll want to consider turning to infrastructure-as-a-service (IaaS) and SaaS. Once done, you can add SD-WAN and replace your router-centric WAN with it. It’ll help you ensure reliable connections, faster access to applications, and integrated security. It may also help you cut costs by streamlining and automating your remote app distribution to offices globally.
How to Transition Your Existing Digital Network to SD-WAN
Right from the outset, security and networking specialists need to work together to develop comprehensive security policies with scalability in mind.
While you’re at it, don’t forget to define your transformation goals and SD-WAN solution scope and then move on to the following steps:
1. Assess Your SD-WAN Management Portal
Your SD-WAN management portal needs to be robust. So, you must identify if there are any issues with the SaaS application, data center, device stack performance, and network. Ensure that the application and connectivity health can be viewed in a single dashboard. It makes it easier to identify and report problems, ensuring that end-user performance is visible. If you want to make network modifications and configurations at any branch office in any part of the world, you should be able to use a portal.
2. Adapt to Real-Time Changes
Security solutions, such as segmenting and encrypting network traffic, must be able to respond to changes in the network that occur in real-time. The reality is that keeping up with the dynamic connections is essential to SD-WAN operations. This method can help the security function track and analyze data while also encrypting and decrypting with SSL/TLS so security teams can stay on top of potential security concerns.
3. Automate Your Security Mechanisms
SD-WANs are designed with integrated, automated security mechanisms built into the network as a best practice. As noted previously, just be aware that certain SD-WANs come equipped with only basic security features (such as basic firewalls); as such, you may want to consider updating to stronger versions.
4. Mitigate Software Vulnerabilities
Modern tech may introduce new gaps into your network architecture, compromising its security. Ensure that your SD-WAN provider has a rigorous vulnerability scanning mechanism and quality assurance (QA) process before releasing their code to the production environment. You should also inquire about their approach to security regarding industry and regional compliance considerations or whether they have conducted any vulnerability scanning and obtained the results.
Lastly, ensure that your SD-WAN provides regular updates to fill security patches.
Top Criteria for Selecting an SD-WAN Vendor
Corporate decision-makers and network planners intending to install an SD-WAN should consider a set of criteria that helps identify a solution’s capabilities and whether they align with the company’s goals. Here are some factors you should look for while picking an SD-WAN vendor.
1. Strong Network Security
When selecting an SD-WAN vendor, it’s good to consider security concerns. Businesses should partner with an SD-WAN provider that places a high priority on security when offering the service. Secure tunnels and encrypted traffic are standard features in SD-WAN, which provides a significant layer of security.
An IT provider, on the other hand, should provide additional layers of security such as:
Round-the-clock monitoring. This should be managed and provided by a managed service provider (MSP) that can monitor and report on its ongoing security status.
Automated threat detection. This can be managed via real-time threat detection software.
Managed firewalls. Make sure the service covers the administration, maintenance, and monitoring of your firewalls
Alerts and notifications. You should be notified instantly regarding potential security breaches
Security incident remediation. What steps are in place to ensure that the breach will be addressed if/when it occurs? Plan ahead of time.
This is all part of laying the groundwork for the overall design you’ve chosen.
2. Control and Visibility
To effectively manage a network, optimize application performance, and keep the entire environment safe, it’s essential to have comprehensive visibility in every aspect of it. As SD-WAN evolves, it can resolve issues more quickly and gain more insight into future expansion.
3. Features and Customization Capabilities
The extensibility of SD-WAN providers should be considered when evaluating the qualities of their products and services. Also, make it a priority to simplify the process of adding further capabilities that promote scalability when needed, such as:
Cloud connectivity
Encryption key rotation
Data Analytics
Programmable APIs (so you can customize and scale SD-WAN gear’s configurations)
4. WAN Bandwidth Requirements
Think about what your WAN bandwidth needs are now and how they might grow in the future (three-five years). Ensure you’re getting the bandwidth you need to get the most out of your system.
As a general rule, the average small business with 10 or fewer employees shouldn’t need more than 10-15 Mbps. But a business that involves downloading large files of content on a regular basis, backup services, and cloud-based file-sharing services will likely need at least 50 Mbps.
5. Costs
Due to the SD WAN’s lack of hardware controls, it’s often regarded as being less expensive than traditional hardware-based networks. But there’s no doubt that the cost of an SD-WAN solution differs from one provider to another. Monitor your consumption expenditures to ensure they’re decreasing as anticipated.
If you’re content with the performance, make sure you only pay for what you’re getting. Don’t settle for shoddy work at a premium price.
6. Deployment Capabilities
It is now possible for your company to centrally manage the deployment of services across a distributed network using SD-WAN and network function virtualization (NFV), or utilizing virtual machines in place of physical appliance hardware.
Final Thoughts on Transforming Your Digital Networks With SD-WAN
SD-WAN provides an effective way for businesses to manage their remote network connectivity means via virtual services. Businesses globally are already benefiting from SD-WAN, and further technological advancements can inevitably increase the amount of business support they provide.
Cloud and SaaS services like Workday, Salesforce, Microsoft 365, and Dropbox can benefit from SD-WAN technology optimized for excellent application performance in on-premises data centers and public or private clouds. This way, cloud-first companies can deliver higher application quality of experience (QoEx) to their customers.
Whether you’re a software creator or software buyer, you’re vulnerable to software supply chain attacks. Here’s how you can protect your company and customers…
What would happen if a popular software (one that’s widely used across your organization and is sourced from a reputable vendor) turned out to have malicious code in it that allowed hackers to remotely access and control your employees’ machines? Unfortunately, that’s not just a hypothetical — that’s how many real-world (and costly) cyber attacks have actually happened.
Software supply chain attacks are one of the scariest types of cyber attacks because they’re carefully planned to cascade “downstream” to achieve the biggest impact possible. The idea here is that the attacker tries to compromise every person and organization using the affected software product or component.
A good example of a supply chain attack is the SolarWinds hack in 2020: hackers gained access to the SolarWinds build servers and inserted malicious code into the codebase for their Orion software. This allowed the attackers to gain access into any organization that installed the Orion software. This means that organizations using the well-known, reputable software product (Orion) were unknowingly giving a sophisticated hacker group access to their systems. Thousands of organizations were compromised this way, including major U.S. federal government and NATO agencies.
As such, software supply chain attacks are a growing concern for both software makers and software buyers:
Anchore’s 2022 research shows that 62% of respondents indicate that software supply chain attacks have impacted their enterprises in the last year.
It only takes one line of compromised code in one piece of software you use to impact all of your customers (and more).
Knowing this, how can you protect your organization against supply chain attacks? Let’s take a look at the basics of supply chain security, then explore practical advice from eight IT and cybersecurity experts on how you can protect your organization and customers. We’ll cover important tips for both software creators and software buyers — we’ve got a little something for everybody.
Let’s hash it out.
Software Supply Chain Security 101
What Is the Software Supply Chain?
Generally speaking, the software supply chain includes everything involved in the software development lifecycle. Practically, that means anyone and anything that could contribute or modify code that’s used in a software product, including:
The software vendor who makes a software product, including their developers and systems.
Creators of any third-party components or libraries included in the software (this could include individuals, organizations, and open-source communities)
Distributors and other vendors who may be able to modify software before it’s delivered to customers
Systems or parties involved in updating software once it’s been installed on the customers’ devices.
In many cases, the supply chain for a given software product can be very extensive, because most software is built using a mixture of code developed in-house and (many different) third-party components. Some of these third-party software components are so ubiquitous that we hardly even think about them — for example, it’s estimated that there are over one trillion SQLite databases in the world because SQLite is used as a component by so many popular software products.
What Is Software Supply Chain Security? It’s How You Prevent Software Supply Chain Attacks
Software supply chain security is about preventing bad guys from using your software supply chain as an attack vector to carry out attacks on your customers. The true targets in software supply chain attacks are your customers; you and your software products are just pawns they can use to achieve their goals.
Software supply chain security is about doing everything possible to prevent bad guys from infiltrating your network and deploying harmful code within your products that will be sent to customers. It encompasses all the policies, tools, and actions you (as a software vendor, for example) use to prevent these attacks.
When there are one or more vulnerable elements in your software supply chain, then your software product and overall organization are at risk. In a broad sense, supply chain cyber security is about securing everything relating to the process of how your software is created, distributed, and supported.
In particular, software supply chain security focuses on ensuring that malicious code or known security vulnerabilities cannot be added to a software product at any point. This includes ensuring that:
Software developers are writing code that follows security best practices
Third-party components (e.g., open-source libraries) are free of malicious code or vulnerabilities
Your codebase is protected against unauthorized code insertions or modifications and you’re tracking all changes that are made (and who made them)
Systems used to build/deploy software is protected against unauthorized access or injections
Software is protected against modification and unauthorized additions during distribution/delivery process to customers
Update processes to protect customers from receiving fake updates or legitimate updates that have malicious code injected
Why Software Supply Chain Security Matters
The truth of the matter is that software supply chain security issues affect everyone. Regardless of whether you’re creating software, supplying it, or buying it from others, no one likes unpleasant surprises. And that’s precisely what you get when you create or operate software with unknown vulnerabilities. But why is implementing strong software supply chain security so important? Let’s quickly go over a few key reasons:
You have a professional responsibility to yourself and/or your customers. As a software creator, you have a duty to adhere to software security standards. You’re responsible for safeguarding the software products, data, and supply chain that connects you with customers.
You’re regulatorily required to secure your data and systems. Building on the responsibility point — you’re also typically required to do so due to industry and regional regulations (depending on where you’re geographically based or countries you do business in globally). A couple of recent related examples can be seen in the National Institute of Standards and Technology (NIST) Special Publication 218 (SP-218), NIST Secure Software Development Framework, and U.S. Executive Order (EO) 14028. This executive order aims to enhance software supply chain security regarding the use of third-party software that federal agencies purchase and use. The NIST guidelines provide information relevant for software producers as well as the software purchasers (i.e., federal agencies).
Your reputation and customers’ trust are on the line. Trust matters, and once it’s broken, you may not get it back. In fact, nearly a quarter (24%) of surveyed consumers told Privitar that they’d either terminate business with companies after they’ve been breached, or they’d do less business with them in the future. As you can imagine, a data breach can have a devastating toll on your customers’ bottom lines, customer relationships, and future business opportunities. Now, imagine if they’re breached because of an issue with your software (due to its vulnerable software supply chain). As the software creator or its supplier, that would have a devasting effect on your reputation as well.
There’s no “re-do” button in software supply chain security. When it comes to securing your software logistics network, either you do it right or you don’t. Closing the stable door won’t do you any good if the horses already ran out. Dedicate the time and resources to secure your software supply chain from the get-go to prevent attacks from occurring.
How to Secure Your Organization’s Software Supply Chain
Most articles that talk about software supply chain security cover the topic from the perspective of software developers. And this is important, as this guide applies largely to that audience. But there are other considerations as well from the perspective of software procurers who buy the software that’s created.
Simply put:
If you’re asoftware developer: You should be implementing the following list of 10 best practices and tips.
If you’re asoftware buyer: Your goal should be to choose vendors who follow best practices like these.
1. Devote the Appropriate Resources to Securing Your Organization
Don’t be stingy when it comes to people, time, and money. Keeping your software supply chain secure should be among the highest priorities, and the reality is that accomplishing this requires a lot of resources.
Now, we’re not saying that throwing money at the problem will magically make all your security woes go away. But having a dedicated budget that’s set aside strictly for security purposes is a smart move and provides the necessary resources your organization needs to harden your defenses. This is money that can be spent in various ways, including:
Upgrading your firewalls and other cyber security systems (such as intrusion detection and response tools)
Adding skilled and knowledgeable workers to your in-house IT team
Investing in third-party service providers to carry out assessments and penetration testing
Incentivizing security-related innovations and initiatives
Increasing cyber awareness and best practices usage among your employees through various trainings
2. Make Security an Organization-Wide Priority for Everyone
A good application security strategy is one that encompasses all elements of your software supply chain. Jeff Williams, co-founder and chief technology officer at Contrast Security, says that achieving a secure supply chain (i.e., as secure as you can make it) boils down to knowing:
What code you write
What tools you use to develop and create software
How you secure your code and systems
Which third-party applications you buy and use
While some leaders may argue otherwise, security isn’t a siloed initiative. It’s a group effort — one that all employees (and other network users) participate in that should be led from the top of your organization. Bradley Jackson, the Director of Software Engineering here at The SSL Store, underscores this idea:
“It’s not the job of one person or a QA team to find vulnerabilities or point out flaws. It’s a team effort — from the developers, to DevOps, DBAs, marketing & bizdev, to ensure they’re not asking for functionality that can’t be done securely — all the way to the CEO to not rush a product to market at the sake of security.”
3. Understand Your Dependencies (Know What’s Going Into Your Software)
Asaf Ashkenazi, CEO of Verimatrix, points out an uncomfortable truth: you often don’t know what code is used in your software and where it was sourced from.
“Whether an organization is CREATING and distributing software products, or they are just USING [third] party software, the libraries used are likely to come from different sources. Whether it is an open source library or a licensed software solution, it’s vital their organization track where these components are used to allow for fast patching in case of a discovered vulnerability or routine security updates.”
Open source repositories are great because they save time and money by not having to create code from scratch. But open source resources can also introduce vulnerabilities that, otherwise, wouldn’t exist in your software or systems. This is why Steve Judd, senior solutions architect at JetStack, by Venafi, cautions using open source repositories without first auditing and evaluating the risks associated with them:
“If a threat actor does compromise a repository, they have the potential to launch a one-to-many attack, which has become the standard in supply chain attacks. Because open source repositories are used so widely by developers looking to save time and resources, popular [artifacts] could be used by thousands of companies. So injecting code into one repository could send shockwaves across multiple organizations, and potentially millions of end users. Ultimately, once the malware makes its way into an application or website, hackers can create disruption, steal data and IP, spy on users and create backdoors.”
Dan Chernov, chief technology officer at DerSecur, describes software-based businesses using the analogy of traditional brick building. In this case, he says that removing one brick from a key location can leave the integrity of a structure at risk of collapse. (Think of a brick that’s located at the top of an arch; if a key brick is missing, it can lead to failure in the overall design.) This is why it’s important to know what you’re putting into your software and to keep tabs on what you’re using and whether those elements have any known vulnerabilities:
“Software vulnerabilities are the open door for hackers into the organization, inside the IT systems which process valuable data. That’s why its vitally important to check all company’s software, developed either in house or via outsourcing as well as open source components, for vulnerabilities and backdoors.
To support this, your organization needs to commit management and resources to tracking the sources of your components and implementing application security practices. It’s an initiative that Chernov says should be performed and managed by your chief information security officer (CISO).
Put a Software Bill of Materials (SBOM) to Use
Another way to help secure your supply chain is to create a software bill of materials (SBOM) for your products. If you’re a company using third-party software applications, ensure they offer SBOMs. In a nutshell, an SBOM is a list of all the various components contained within your software, web app, or device (such as libraries, tools, and plugins). This way, you know exactly what tools, code, and resources have been used to create your software artifact.
Think of an SBOM like a recipe card or ingredient list on a packaged food product. If you have a food allergy, you can look at a food product’s list of ingredients to know whether it is something safe for you to eat. If it contains something you’re allergic to, you know that eating it would be risky and could make you sick (or worse).
Likewise, knowing what elements (proprietary and outsourced) are contained within your software helps you and your customers achieve greater supply chain visibility and security. Something else that’s vital to visibility and security is knowing whose hands are in which pies.
“SBOMs are especially important when identifying cybersecurity risks in critical application infrastructure across industries. It’s also worth noting that the U.S. government is constantly releasing new directives and best practices to secure the software supply chain to ensure the private vendors they work with provide the most secure products.
While agencies both in the U.S. and internationally may soon be required to create SBOMs to retain those government contracts, I believe organizations will quickly recognize their importance in not only cybersecurity but general software hygiene – and it will become a standard practice in any organization creating software.”
4. Practice Secure DevOps (SecDevOps or DevSecOps)
Implementing a secure development and operations life cycle should be a no-brainer. But for some reason, some companies either haven’t received the memo or they choose to put their fingers in their ears and start humming. So, since we have your attention, let’s be clear: if you develop or publish software, then it’s imperative that you follow a secure software development life cycle.
Bad guys are always looking for ways to compromise systems and gain access to valuable information. By not securing your devops life cycle, you’re not only leaving your own systems at risk but also jeopardizing your customers’ systems and data.
Williams emphasizes this point, showing that it’s the sum of all parts, and not just one-off independent elements, that makes for greater software supply chain security. He describes SolarWinds as being a wake-up call that highlights the importance of securing supply chains that extends beyond traditional cyber security methods.
“We cannot fix this with an occasional vulnerability scan or penetration test. We must prevent adversaries from getting into the software factory via code, libraries, tools, and platforms.”
Prioritize Security Over Speed or Other Interests
This next truth is a bitter pill your company’s sales and finances execs may not want to swallow: the security of your software should take priority over the speed of its release and distribution. According to Williams:
“Collaboration between developer teams and security teams is key here. But there has been friction in the past as developers are under pressure to work at speed, and security teams are under pressure to work securely. Unfortunately, these concepts don’t always align, and one is prioritized over the other – usually speed over security, hence why we see so many attacks targeting software supply chains.”
Digitally Sign Your Software Using a Code Signing Certificate
Code signing is a technique that enables you to attach a special signature of sorts to your code, containers, software and other executables. This cryptographically based method ensures the integrity of your software (i.e., so your customers know it hasn’t been tampered with since you signed it) and that helps customers know your software is authentic (i.e., that it was published by you and not an imposter).
Now, it’s no secret that we love code signing here at Hashed Out. After all, it’s a public key infrastructure (PKI) security technique that enables you to protect your software and assert your digital identity. (And, as you know if you’ve read our previous articles, we love digital identity!) Unfortunately, not all companies or developers opt to use them. This results in unsightly “unknown publisher” or “software not trusted” warning messages displaying to their users:
Image caption: A set of screenshots that shows the differences in messages that display for digitally signed software (right) and software lacking a digital signature (left).
5. Manage Access to Your Systems and Servers
Ah, yes, people. Human beings are, simultaneously, the greatest contributors and risks to the security of your supply chain and organization overall. All it takes is one moment of inattentiveness for an employee to fall for a phishing email that could compromise their credentials. (Yup, it happens to the best of us.)
Of course, securing access is a general cyber security best practice for all organizations. But when it comes to software supply chain security, it’s crucial to ensure that no one tampers with your software during the development process in particular.
Limit Who Has Access to What
Limiting how many people have access to privileged systems also limits the exposure risk of those systems when things go wrong. An attacker can only access the limited systems and data associated with that individual user’s profile. This is why access to your systems, data, and servers (especially your development and production servers) should be managed carefully and privileged access given sparingly.
Here’s a good rule of thumb to abide by: everyone doesn’t need access to everything. Only assign permissions and privileges to users whose roles and responsibilities require them.
Use Secure Authentication Methods
It’s no secret that cybercriminals love passwords. Compromising passwords is a very lucrative practice for bad guys. People tend to use really crappy passwords that are easy to guess via brute force attacks, or they give them to attackers who trick them using phishing tactics. A good way to avoid password-related security issues (i.e., have strong password security) is to avoid using them altogether.
One of the things we love to highlight here at Hashed Out is the use of public key infrastructure. (PKI is the foundation of internet security as we know it.) When it comes to secure authentication, something that PKI offers is the ability to use cryptographically secure mechanisms (i.e., a client authentication certificate) to:
Log in to systems without having to use usernames and passwords that can become compromised (and leave your systems at risk), and
Verify it’s really your employee who’s trying to access a protected resource (i.e., not an unauthorized user or cybercriminal).
Another option is to use multi factor authentication (MFA) apps that allow you to authenticate without having to type in any passwords. For example, you might receive an app-based push message on your mobile device that prompts you to authenticate whenever you try to access a protected resource.
Image caption: A screenshot of the verification message I received when I tried logging in to a service.
6. Scan and Monitor Your Digital Assets
Even if you’re doing everything right to keep your network, website, IT systems and other digital assets as secure as possible, attackers can exploit vulnerabilities to upload malware. The same can be said about your website. When customers then visit your website, instead of downloading your legitimate software or patches, they may find themselves installing malware instead that’s been uploaded to your site.
Part of this entails keeping your website’s plugins, themes, and codebases secure. Jeremy Clifford, CEO of RouterCtrl, has worked as a network specialist and engineer for more than 20 years. He says that GitHub is not just a way to maintain a code history, but it’s also a repository that can help you secure and protect your supply chain.
Clifford shares his insights regarding the importance of maintaining a secure codebase:
“Keeping the codebase secure should be the number one priority of […] any tech company. Not only could nefarious code bring your site down, for example, but they could also insert code into your site that would collect and send personal data, turning your innocent site into an unwilling accomplice to a crime.
[…] require that all code merges require multiple peer reviews and that merges into the master or production branches can only be done by certain approved parties. This way you’ll get multiple sets of eyes on each code change to ensure that only the intended changes make it in.”
Know What Software and Devices You Have on Your Network
Having visibility is critical to network security. If you don’t know what connects to it (devices, applications, etc.), how can you keep it secure? This is the underlying concern of shadow IT for many organizations.
Having unknown and untracked assets on your network like jumping into a lake filled with alligators while wearing a blindfold: you’ll never know what direction an attack is going to come from, and there’s no way to defend yourself.
7. Patch and Update Your Systems Regularly
If your systems aren’t patched and secure, then it means there are vulnerabilities that bad guys can exploit to use as an access point to your network (and, ultimately, your development and production servers) Patches are kind of like life vests: getting one won’t do you any good if you don’t bother wearing it when you go boating.
Let’s take Microsoft’s Patch Tuesday updates as an example. Almost every Tuesday, Microsoft rolls out updates for different products to help organizations and users mitigate the latest vulnerabilities. Back in 2017, Microsoft rolled out an update of their legacy Windows operating systems to mitigate security issues relating to vulnerability within their systems that resulted in an exploit known as Eternal Blue. However, many companies globally failed to apply the update within a reasonable amount of time.
The result? A global ransomware attack that resulted in catastrophic damages for governments and private sector entities in more than 150 countries. For example, the United Kingdom’s National Health Service (NHS) found its operations screeching to a halt. Thousands of surgeries and appointments were canceled and, in some cases, institutions had to divert emergency responders to other facilities. There’s also the issue of ransomware attacks causing fatalities by targeting critical infrastructure…
Eliminate Outdated Components and Software
Time isn’t kind in many aspects. As humans, we grow older and we start to feel like we’re falling apart. The same happens with software and other technologies over time — they become less secure, particularly when their manufacturers stop maintaining them with new patches and updates.
Ashkenazi, who has a background in systems design engineering and architecture, says that a critical step that often gets overlooked is managing and rotating out old technologies. “Continually ask yourself if you’re using a timely cycle to age out some of the stuff that is old and probably (or definitely) less secure.” He points out that some suppliers stop supporting their software with updates and security patches. So, it’s important to examine your software supplier’s track record to see if they’re one of the ones that continue support or drop off after a few years.
8. Set Security Requirements With Third-Party Vendors
Do you know what your software vendors are doing to keep their software — and, by proxy, your organization — secure? If the answer is no, we’re not surprised.
The NCC Group’s research we mentioned at the beginning of the article shows that almost half of surveyed organizations (49%) neglect to set security standards with their service providers ahead of time. But what makes matters worse is that 34% also indicate that they don’t “regularly monitor and risk assess their suppliers’ cyber security arrangements,” either.
This is particularly concerning considering that third-party risks are frequently the result of contractors or service providers having access to sensitive systems and data. Think of the 2013 Target data breach when the network credentials of one of their third-party HVAC vendors were hacked, giving attackers access to Target’s systems.
Ilam Padmanabhan, solution delivery manager at Nets Group, has two decades of experience in the tech and financial services industries. Padmanabhan says it’s important to both stay abreast of what vendors are doing to keep their software secure and to keep them informed about any vulnerabilities they discover on their systems:
“To ensure the security of their suppliers, [companies] should conduct regular security audits and require their suppliers to meet certain security standards. They should also establish communication protocols so that they can quickly notify their suppliers of any vulnerabilities that are discovered.”
Conduct Risk Assessments of Your IT Systems
Keeping an eye on your IT ecosystem entails more than just monitoring your network. It’s also about keeping tabs on everything that touches your network — applications, personal and company devices, IoT devices, etc. You need to know who has access to everything, including third party vendors and contractors. Part of this entails performing cyber security risk assessments that help you identify vulnerabilities and prioritize mitigation efforts.
If you’re not sure how to perform a cyber risk assessment, no worries. We’ve already got a resource ready to go for you. Of course, simply figuring out what risks there are and how to prioritize them isn’t enough. You also need to have plans in place for how to respond to them and for how to keep your business going…
9. Create Business Continuity, Incident Response and Disaster Recovery Plans
We get it — accidents happen and, sometimes, things go wrong. These types of scenarios span the gamut from natural disasters to man-made issues like cyber attacks. But if you’re smart, you’ll plan ahead for when things go wrong (because, inevitably, they will) so you’ll have plans in place for how to respond to bad situations.
A few examples of some of the plans you can create and implement include:
Business continuity (BC) plan — A BC plan provides guidance on keeping your business up and running while crap is hitting the fan. It’s easier said than done, but with the right plan and people in place, it can be enough to keep your business from failing in the interim.
Incident response (IR) plan — This document serves as your guide for what to do when you’re in the thick of things and feel like you’re facing down a dragon. The goal is to stop whatever’s happening from happening and to prevent further damage from occurring.
Disaster recovery (DR) plan — A DR is all about helping your business in the aftermath of whatever ungodly scenario your organization has just endured. This typically involves implementing data backups and trying to get your organization back to being fully functional.
10. Train Your Employees on General Cyber Security and More Specialized Practices
A key part of any cyber security strategy is providing educational training and resources to your staff and other network users. In general, everyone who touches any company device or has access to your network should be trained to increase their cyber awareness and to recognize threats. But the training doesn’t have to stop there; you also should provide more specialized, in-depth or technical training to increase the security of your privileged users. This is something that you can offer in house or consider hiring a third party to handle for you.
Regardless of which approach you take, the important takeaway is to educate your employees. They’re your first line of defense in all aspects of cyber security, including the protection of your supply chain.
Train Your Organization’s Software and Technology Buyers
The same training concept applies to technology buyers, too. If you want to ensure that your company is using only the most secure software, educate your employees who are responsible for making those purchases. Provide them with guidelines and standards they can refer to when vetting prospective software creators and their products.
Meet the Experts
We offer a special thanks to all of the experts who shared their insights with me to write this article. They’re listed in alphabetical order by last name:
Asaf Ashkenazi, CEO at Verimatrix
Dan Chernov, chief technology officer at DerSecur.
Jeremy Clifford, CEO of RouterCtrl.
Brian Fox, CTO of Sonatype and an OpenSSF member.
Bradley Jackson, Director of Software Engineering at The SSL Store.
Steve Judd, senior solutions architect at JetStack, by Venafi.
Ilam Padmanabhan, solution delivery manager at Nets Group.
Jeff Williams, co-founder and chief technology officer at Contrast Security.
TL;DR: A Quick Overview of Supply Chain Security
Still reading? Awesome. We hope you’ve found these experts’ insights informative and useful. If you jumped to this section to save time, we’ve got a quick summary for you of why software supply chain security matters to software creators and buyers alike:
Strong and effective supply chain security comes from the top-down. Security isn’t a one-man-band kind of thing. It’s an initiative that should be led by your organization’s board and other leaders and should be owned by everyone.
Know what’s in your products (or the third-party products you use). As a provider, you need to review and approve every component that is included in your software. This helps you (and your products’ users) achieve greater IT environment visibility and security.
Carefully manage access and implement secure access methods. Only assign access to those who need it to do their jobs. Use authentication methods that offer the highest levels of security (like MFA and PKI-based authentication).
Keep your systems patched and free of vulnerabilities. This should be a no-brainer but it’s worth reminding everyone anyhow. Unpatched systems are vulnerable, and vulnerabilities are big, flashing neon signs that tell cybercriminals “I’m open to attack!”
Digitally sign your software to inform users your software is legit and unaltered. If you want your customers to know that your software is authentic and hasn’t been modified since you made it, a good way to ensure this is to digitally sign it. Attaching a digital signature uses cryptographic functions to assert your digital identity and offer assurance about the integrity of your software.
Alright, that’s it. We’ve kept you long enough and are sure you’ve got work to get back to now. Remember: your software is only as secure as you make it. Invest the time, resources, and efforts now to save yourself a lot of headaches — and money — in the future. Don’t allow yourself to sacrifice security for the sake of getting your products out faster.
Digital certificates are akin to the internet’s versions of certificates of authenticity. Here’s what you need to know about them and the public key cryptographic technologies that make them work
Digital certificates and/or signatures make your world more secure virtually everywhere you look online. These tools allow you to send secure emails and exchange sensitive information remotely without having to worry constantly that your data might fall into the wrong hands.
But what is a digital signature? What is a digital certificate? How do they integrate seamlessly into your everyday life as both a consumer and service provider (even if you don’t know it)? We’ll answer all of these questions in this article that breaks down the difference between a digital signature vs digital certificate.
Let’s decode it..
Digital Certificate vs Digital Signature: A Look at the Differences Between the Two
Digital certificates and digital signatures are just two halves of the same coin. When you’re talking about a digital signature vs digital certificate, each plays a role in establishing and validating digital identity and aids in helping your organization facilitate digital trust. Digital trust is critical to elevating your brand and helping customers feel confident and secure doing business with you.
We’ll go more in-depth on each of these concepts throughout the article. But first, we know some of you are in a hurry and don’t have much time to read this article. We’ve put together a brief overview so you’ll quickly get the gist of the differences and can move on your way:
Digital Certificate
Digital Signature
What It Is
A small data file (X.509 format) that contains identifying information (usually about a person and/or an organization)
It’s a signed digital asset that consists of a string of characters created by hashing data and encrypting the resulting value. You use a digital certificate to create a digital signature.
How to Describe It to Your Non-Technical Colleagues
It’s like a passport for the digital world: it’s issued by a trusted third party and offers assurance that you’re you
It’s like a notarized signature; it’s often used to show that digital assets (such as documents, messages, files, etc.) you create are authentic and haven’t been altered somehow
What It Does
A digital certificate ties your organization’s verified identity to a digital asset (website, email, software, etc.)
A digital signature shows who created a file, message, or other digital asset, and that it hasn’t been changed since it was signed
How It’s Created
Create a certificate signing request (CSR) and send the information to the certificate authority. They’ll verify your identity and issue the certificate
In most cases, you’ll need a digital certificate in order to create a digital signature. Once you have a certificate, many platforms (Windows Server, OpenSSL, Microsoft Word, Adobe, etc.) make it easy to create and apply a digital signature through the use of a hash function and encryption
Where You Can Find One
Installed on web servers, web applications, email clients, computers, mobile devices, IoT devices, etc.
Many important files (such as software installers, PDFs, secure emails, etc.) contain digital signatures.
How Long It Is Valid
Each digital certificate is created with a set validity period — i.e., it has both issuance and expiration dates
Digital signatures can be valid far longer than the certificate that created it when it is timestamped
Alright, now that we’ve had this overview that highlights a digital signature vs digital certificate, let’s dive a little more in depth into each of these elements…
What Is a Digital Certificate?
A digital certificate is a digital file containing verifiable information about you or your organization that validates your authenticity. Basically, it’s a way for the other party you’re connecting to, to check whether you are who you say you are (i.e., you’re not a fraudster).
Digital certificates are kind of like the organizations that issue certificates of authentication for athletes’ autographs. If I want to ensure that I’m getting hockey goaltender Andrei Vasilevskiy’s signature (Go Bolts!), I’m not just going to buy it from some random person on eBay. I’m going to get it from a reputable source that provides a genuine certificate of authentication.
Likewise, the same concept applies to installing code, software, and other executables from reputable sources. You won’t just download unsigned software from a third-party website that could be counterfeit and contain malware, right? (Please say you won’t.) It’s too risky and leaves you vulnerable to data compromise, identity theft, and a slew of other security issues.
Digital certificates are X.509 files that you’ll find at the heart of public key infrastructure (PKI). They come in multiple varieties that serve various purposes:
Code signing certificates help you prove the authenticity of your software, containers, and code and protect it against unauthorized modifications.
Image caption: A screenshot of the code signing certificate information that displays in Chrome for one of our company’s digital certificates.
Document signing certificates help you prove the authenticity and integrity of your Microsoft Office and PDF files. (NOTE: Not all document signing certificates can be used to digitally sign Adobe PDFs.)
Email signing certificates help you prove to recipients’ email clients and servers that your emails are legitimate and haven’t been altered. They also enable you to send secure, encrypted messages to recipients who also use email signing certificates.
Image caption: A screenshot of the email signing certificate information that displays in Chrome for one of my digital certificates.
Client authentication certificates (AKA personal authentication certificates) help you remotely verify your identity so you can access web apps and other resources online. These are frequently the same certificates as email signing certificates
SSL/TLS certificates help you prove that your website is authentic (owned by you) and enables your server to establish secure connections with users to protect their data in transit.
Image caption: A screenshot of the SSL/TLS certificate information that displays in Chrome for TheSSLstore.com.
What Is a Digital Signature?
A digital signature is something you apply to a specific file (using your digital certificate) to prove that the file was created by you and is authentic. In the most basic sense, a digital signature is a way to prove you’re really you (authentication) and that something you created is legitimate (data integrity). More technically speaking, it’s data that proves your identity and that the digital asset you’ve created and signed hasn’t been secretly modified.
In a more technical sense, digital signatures are the values that result from applying a hash function to the data of the digital asset (software, email, document, etc.) you wish to protect and authenticate. This creates a string of data known as a hash value, which you then encrypt using a cryptographic key.
There’s sometimes a bit of confusion surrounding digital signatures and electronic signatures. You’ll find people and companies within the industry referring to them interchangeably. However, that’s not quite accurate. A digital signature is a type of electronic signature, but not all electronic signatures are digital signatures. It’s kind of like how all fudges are desserts, but not all desserts are fudge.
An electronic signature is the digital equivalent of your handwritten signature, whereas a digital signature is something else that doesn’t always have a visual element representing it. Electronic signatures can often be mimicked or faked, but digital signatures cannot be easily copied or faked.
Image caption: A screenshot that shows the difference between an electronic signature (left) and a digital signature’s visual mark as represented by Outlook and Adobe PDF.
Timestamping Extends the Life of Your Digital Signature
If you want to get the most out of your digital signature, use a timestamp. Timestamping is a method of proving that whatever you signed was signed at a specific moment. It’s an indelible record that shows when your digital asset was signed or modified. By adding a timestamp to something you digitally sign, you’re also extending your signature’s longevity.
Image caption: A screenshot of the digital signature and timestamping information for a version of JetBrains software that was downloaded.
Of course, you don’t always have to timestamp your digital signature; it’s considered an optional feature in some use cases. But timestamping is something you should definitely consider doing when signing software and documents. Why?
Timestamping your digital signature enables it to be trusted years beyond when your digital certificate expires.
Adding a timestamp provides a verifiable way to show the precise moment when something was digitally signed.
Adding a timestamp to your code also mitigates the error messages that would otherwise appear when your digital signature certificate expires. It also means you don’t have to re-sign and release a new version of your asset (unless you changed the file somehow).
Trying to fake your digital signature’s timestamp would be challenging for cybercriminals to achieve.
There’s a bit of a misnomer that timestamping means that your digital signature is valid forever and will never expire. This isn’t the case. Your signature will eventually expire; it just won’t expire as quickly as your digital signature certificate does.
Digital Signatures and Certificates Are at the Heart of Digital Trust
Nowadays, you always hear people throwing around the term digital transformation, which is all about integrating digital technologies to fundamentally enhance your organization (e.g., increase connectivity and operational efficiencies). But there’s another concept that isn’t just a buzzword and deserves more attention than it receives: digital trust.
Digital trust is everything relating to establishing and upholding trust — it’s the behind-the-scenes processes, compliance, and security mechanisms that make trusting your brand possible for customers. At its core, digital trust boils down to three key elements:
Digital identity — Offering assurance regarding your verifiable digital identity so they know you’re real and aren’t a shyster,
Data integrity — Providing assurance and the means for customers to verify that they can trust your asset’s legitimacy, and
Encryption — Securing communications and data and communications so they can feel confident doing business with you.
Now, I’m going to say something a bit controversial here: you don’t deserve your customers’ trust. While this may sound very negative, the truth is that trust isn’t something customers should give blindly; those days are long gone. In the Age of the Data Breach, trust is something you should — and must — strive to earn.
You can have the fanciest office and IT technologies at your fingertips. But without achieving and securely managing digital trust, your digital transformation is half-baked and won’t live up to your (or your customers’) expectations.
Keeping Your Certificates Secure Requires Careful Management
Your digital certificates and the signatures they create won’t do your business any good if you don’t bother to keep them — or, more importantly, their keys — secure. You see, every digital certificate is issued with a key pair. In the case of publicly trusted certificates (such as the ones we’ve mentioned that are used for external uses), that keypair includes a public and private key. Public keys are available to virtually anyone, but private keys are secrets that must be protected.
As of 2020, Keyfactor reported that the average business’s IT environment has an average of 88,750 digital certificates and keys to authenticate systems and secure data. In 2022, Keyfactor also reported that the average number of “internally issued certificates in an IT organization alone” has surpassed 267,000.
If a bad guy manages to get their grubby paws on even one of your organization’s private keys, then you’re in for a world of pain. A compromised key can lead to everything from data compromises, unauthorized modifications, losses, and theft to costly data breaches and compliance issues. Not only will your reputation suffer potentially irreparable harm, but your customers may, too. Needless to say, this will have a devastating effect on your bottom line.
This is why it’s essential to carefully manage and monitor your PKI. This entails keeping visibility of your IT environment and the certificates and keys within it, managing who have access to your keys and resources, and rotating out certificates and keys as they expire or, on the rare occasion, become revoked.
A carefully managed PKI helps you achieve digital trust and makes for a healthy and successful business.
Final Thoughts on a Digital Signature vs Digital Certificate
As you’ve learned, digital signatures and certificates aren’t so much an either/or kind of thing: you need both to secure your organization and its data. To assert your digital identity, you need to use a digital signature. In order to create a digital signature, you need to have a digital certificate. But when creating your digital certificate, a reputable third party (i.e., a CA) must use their trusted root’s digital signature to offer assurance that your organization has been properly vetted and can be trusted… it goes on and on.
A software bill of materials lists the “ingredients” in a software product, making it easier to identify and avoid security risks
Unless you’ve been living under a rock the past few years, you’ve likely at least heard of Log4j. This is an Apache open source library that’s commonly used in just about everything Java-related online. Unfortunately, in late 2021 the logging package was discovered to be critically vulnerable to remote code execution attacks, meaning an attacker could exploit it to install malware (e.g., ransomware) onto vulnerable systems and inject larger networks.
Cloudflare CEO Matthew Prince reported on Twitter that there were 400 confirmed exploit attempts per second. But that’s just one estimate — according to The Washington Journal, Akamai Technologies said it observed 10 million such exploit attempts per hour. Research from Check Point also showed that the attackers were rolling out new variants of the exploits — more than 60 in under 24 hours.
That’s a lot of exploits and a lot of variations to boot. Considering that the Log4j vulnerability affected major companies like Amazon, Apple, and IBM, it’s no surprise that it had companies globally worried.
But what makes the situation particularly concerning is that many companies weren’t aware that the products they use contained such vulnerable elements. If only there was a way that organizations could know exactly what components are part of the software they use… Oh, wait, there is: they could use products that come with a software bill of materials (SBOM).
But what is a software bill of materials and how can it help organizations mitigate some of the cyber risks facing their organizations and networks?
Let’s hash it out.
What Is a Software Bill of Materials (SBOM)?
A software bill of materials is a list of the base elements (such as code libraries) used to create a product. Basically, it provides details and information that outline the relationships between the various elements of the software in your supply chain. The National Telecommunications and Information Administration (NTIA) has a bit more technical definition for an SBOM, describing it as “a nested inventory for software, a list of ingredients that make up software components.” It includes everything from version information and what companies created those elements.
Putting it more simply, SBOMs enable companies to know exactly what goes into their software — ideally, so they can keep a close eye on any dependencies. So, going back to the Log4j example, if you’re using software that includes the vulnerable library, you would know instantly because Log4j would be listed in the SBOM. You could reach out to your vendor to ensure they’re providing a patch using an updated version of Log4j. But you can’t assess or mitigate specific cybersecurity risks if you don’t know they exist. This is where an SBOM can help.
An analogy that’s commonly used to describe these lists of components is the ingredient labels on packaged food items. (We’ll speak more to that in a minute.) The purpose of an SBOM is to create transparency and help companies identify dependencies in their software supply chains. This is because, as a purchaser, you’re supposed to receive or be able to access SBOMs for products you purchase. This way, you know a good amount of information about your supply chain.
SBOMs are something that can be used to address a wide variety of security issues for everything from software to IoT devices.
Even the U.S. Government Encourages Using SBOMs to Improve Security
In fact, the May 2021 U.S. Executive Order (EO 14028) on Improving the Nation’s Cybersecurity calls upon the use of SBOMs to help strengthen the defenses of U.S. federal information systems. (Government agencies are now required to collect them from software suppliers.) The National Institute of Standards and Technology (NIST) developed the Secure Software Development Framework (SSDF) to aid this initiative, and it requires software bill of materials information to be included.
Component hash (yup! Cryptographic functions play a key [excuse the pun] role here, too)
Unique identifier
Dependency Relationship
Timestamp
For a complete list of minimum requirements, check out NTIA’s SBOM Minimum Elements Report. It breaks down the minimum elements that should be addressed in an SBOM into three main categories:
Data fields,
Automation support, and
Practices and Processes.
Do SBOMs have to be created at the time you’re developing your software? Not necessarily. You also can create SBOMs retroactively. The only thing to note about that is that it might not be as complete as an SBOM that’s generated as part of your software development life cycle (SDLC) process.
SBOMs Are Typically Meant to Be Read By Machines, Not People….
An SBOM isn’t something that just anyone can look at and read easily; it’s presented in one of a few standardized formats that are readable by computers (but not human beings, unless you know what to look for) to improve integration and automation. These three standards (listed in alphabetical order) include:
CycloneDX, which also works for software-as-a-service (SaaSBOM), hardware bill of materials (HBOM), and other uses. The file format for this type of SBOM is .xml.
Software Package Data eXchange (SPDX), which is an international open standard (ISO/IEC 5962:2021). Acceptable file formats include .json, .spdx, .rdf .xls, .xml, and .yml.
Image caption: A screenshot from NTIA that we’ve highlighted to illustrate the different informational requirements that a software bill of materials must include. Original image source: NTIA.
Who a Software Bill of Materials Benefits (Spoiler Alert: Everyone)
According to the White House’s Executive Order, SBOMs benefit virtually everyone who develops, manufactures, purchases, or operates software or devices that use said software. But the truth is that a software bill of materials also indirectly benefits the consumers who are served by these companies and service:
“An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability.”.
Yup. While SBOMs are typically promoted as being good for software buyers and operators, the truth is that they’re also useful for broader audiences. So, you see, it’s good for your organization regardless of where you fall in the supply chain.
But now that we know what an SBOM is in a general sense, let’s take a closer look at this security tool and how it aids your organization’s software supply chain.
A Look at How a Software Bill of Materials Breaks Things Down Within the Supply Chain
Your software supply chain comprises everything from where the individual components came from that are used to create the products you use and how they’re manufactured, distributed, and supported. Some categorizations of the supply chain talk about custom code, third-party components, development and building environments, delivery, etc. Basically, it’s all about sourcing your components (internal or third-party dependencies), building your software, storing and deploying it, and providing ongoing support (via patches) while it’s being used by the intended users.
However, to simplify things a bit more, we’re going to look at what the software supply chain ecosystem looks like based on a traditional supply chain (based on information shared in NTIA’s SBOM explainer video):
Image caption: A basic diagram that illustrates the software supply chain ecosystem and some of the parties involved in it.
Let’s imagine, for a moment, that you’re an IoT device manufacturer that uses third-party software as part of your supply chain. This is how the above breakdown would play out with regard to you and your business:
Source parts refer to all the base elements used to create the product.
Compound components refer to any elements in the final product that are created using other elements (e.g., a third-party’s library or open source code). Not all software manufacturers provide information about what these components are.
The final assembled product(your software) is the end product created when you combine all of the parts.
Operator(s) or vendor(s) is the term that refers to your direct customers or service providers that use your product.
Consumer(s) refers to the people that your customers use your product to provide services to.
An SBOM Is Like the List of Ingredients You’d Find in Your Favorite Foods…
When you’re at the grocery store, do you stop to read product nutrition labels and ingredient lists? If you’re like me, you do because you want to know exactly what you’re putting into your body.
It’s a good idea to take a similar approach when adding software and devices to your network. If you want to keep your network secure, then you’ll want to check every device, software, or system carefully you connect to it for known vulnerabilities. Knowing what libraries, drivers, operating systems and open source resources are used goes a long way in helping you assess and mitigate vulnerabilities.
Let’s consider a quick example with one of my favorite special occasion meals: Fettucine alfredo. Say, a friend is having a small get-together at her house and I decide to bring over a dish of homemade fettuccine alfredo for the occasion to share. Sounds great, right? It is, so long as no one has any food allergies to any of the ingredients I’m using in my dish.
But how can someone tell whether there might be something in my fettuccine alfredo that might cause an issue? Let’s first consider the list of ingredients. My fettuccine alfredo recipe is pretty simple as it contains several basic ingredients:
Heavy whipping cream
Homemade salted butter
Freshly grated Parmesan-Reggiano cheese
Freshly grated Pecorino-Romano cheese
Garlic
Salt
Black pepper
Italian parsley
Homemade gluten free fettuccine pasta
If I were to break up this item, we’d be looking at the following breakdown of items:
Looks simple enough, right? Not quite… There’s more to it because of the “hidden ingredients” that people might not know about if they aren’t disclosed.
Some Ingredients Are Made Up of Other Unknown Ingredients
Image caption: An example food nutrition and ingredient label.
A few of these items — the two cheese and the gluten free flour — are created through manufacturers whose products I like and trust. So, knowing this, let’s consider the supply chain for these items — particularly the compound components. These items may have other additives that I might not be aware of unless I stop to read the product label. Let’s consider a quick example using parmesan cheese.
The ingredients for the brand of parmesan cheese I typically use contains cultured cow’s milk, enzymes, and salt. (Note: If I bought the pre-grated variety, additional components would be added, such as cellulose and natamycin — this is why I buy the blocks of cheese and grate them myself!) So, in this case, that means the enzymes and cultured milk need to be added to my list of ingredients.
Likewise, if I looked at the ingredient list for the Pecorino-Romano cheese or the gluten free flour I’d use, there would be several additional items I’d need to add to my list of components. And it would also be important to know where the ingredients the manufacturers used actually came from. For example:
The Pecorino-Romano cheese I use is imported from Italy and it contains sheeps milk and rennet.
The flour includes multiple other ingredients — sweet white rice flour, whole grain brown rice flour, potato starch, whole grain sorghum flour, tapioca flour, and xantham gum.
This means my ingredient list now looks more like this:
Why You Need to Know Which Ingredients Are Included in Your Software
See how much longer the list of ingredients became now that we’ve added all of these “hidden” ingredients? Now, ask yourself what would happen if one of your friends was allergic to milk, tapioca flour, or eggs but you didn’t know it. If they didn’t know those ingredients were included in the meal, it could lead to a potentially serious medical emergency, depending on the severity of their allergic reaction.
Likewise, similar concerns apply to your software and hardware devices. While the concern isn’t a food allergy or medical concern necessarily, not knowing what’s included in your software supply chain leaves your organization, network, and customers at risk. Knowing the A-Z of your software supply chain helps you stay abreast of any potential vulnerabilities and exploits you need to address before bad guys use them to attack your network and organization. This is crucial for risk analysis and mitigation activities, where you need to know how and where your systems are vulnerable.
The truth is that it’s rare to find a company that builds its software or hardware components entirely from scratch. (Doing so is just too complex, costly, and time consuming.) Instead, they integrate third-party and open source elements such as frameworks and libraries. When you consider that these components often operate with the same permissions as the software they’re a part of, it means the risk can be significant.
SBOMs help you have a better understanding of your supply chain and everything involved in it. They also help you better manage and mitigate risks by using them to analyze known vulnerabilities. This is why it’s best for them to be stored in a centralized repository that applications and systems can easily access and use.
Can’t a Software Bill of Materials Be Faked?
As with any electronic file, yes, there’s always a risk of that happening. However, there are safeguards that could be used to prevent digital tampering and to prove something is legitimate. One such method is to digitally sign your file before releasing it with your software. A digital signature is a way to simultaneously show that your file is authentic and hasn’t been tampered with since it was signed.
Is a digital signature required for use with SBOMs? No. But as Dean Coclin (CISSP) points out, one good option is to “use a cloud-based code signing service, which allows for uploads of code (or the hash) to be signed by the service and returned to the developer.”
Final Thoughts on SBOMs (And Why They Should Be Part of Your Risk Management Strategy)
Trying to mitigate risks for your software without knowing all the different components nested within it is like going to a dinner party when you have a severe peanut allergy and not bothering to ask if any of the dishes contain nuts. It’s not a smart practice and puts you at risk of a severe medical — err, cybersecurity episode. Instead, ask those questions and avoid the potential headaches, non-compliance issues, financial penalties, and lawsuits that you otherwise may face.
Nowadays, it’s uncommon for software developers to write all of their code from scratch. It’s far more common for devs to integrate open source code into their products because it’s cheaper and easier. As the saying goes: Why reinvent the wheel?
Making software bills of materials a standard component of every piece of software is a smart move. SBOMs provide the added layer of transparency organizations need to keep their data and networks secure and aid in making the vulnerability assessment and mitigation process a lot easier.
The next time you’re shopping for new software, be sure to speak with your vendor to see if their products have SBOMs available. Don’t be surprised if they don’t but be sure to ask anyway to make it clear that this is something you want to see as a software purchaser or operator.
In May 2022, we announced our quest to simplify databases – building them, maintaining them, integrating them. Our goal is to empower you with the tools to run a database that is powerful, scalable, with world-beating performance without any hassle. And we first set our sights on reimagining the database development experience for every type of user – not just database experts.
Over the past couple of months, we’ve been working to create just that, while learning some very important lessons along the way. As it turns out, building a global relational database product on top of Workers pushes the boundaries of the developer platform to their absolute limit, and often beyond them, but in a way that’s absolutely thrilling to us at Cloudflare. It means that while our progress might seem slow from outside, every improvement, bug fix or stress test helps lay down a path for all of our customers to build the world’s most ambitious serverless application.
However, as we continue down the road to making D1 production ready, it wouldn’t be “the Cloudflare way” unless we stopped for feedback first – even though it’s not quite finished yet. In the spirit of Developer Week, there is no better time to introduce the D1 open alpha!
An “open alpha” is a new concept for us. You’ll likely hear the term “open beta” on various announcements at Cloudflare, and while it makes sense for many products here, it wasn’t quite right for D1. There are still some crucial pieces that are still in active development and testing, so before we release the fully-formed D1 as a public beta for you to start building real-world apps with, we want to make sure everybody can start to get a feel for the product on their hobby apps or side-projects.
What’s included in the alpha?
While a lot is still changing behind the scenes with D1, we’ve put a lot of thought into how you, as a developer, interact with it – even if you’re new to databases.
Using the D1 dashboard
In a few clicks you can get your D1 database up and running right from within your dashboard. In our D1 interface, you can create, maintain and view your database as you please. Changes made in the UI are instantly available to your Worker – no redeploy required!
Use Wrangler
If you’re looking to get your hands a little dirty, you can also work with your database using our Wrangler CLI. Create your database and begin adding your data manually or bootstrap your database with one of two ways:
Migrations are a way to version your database changes. With D1, you can create a migration and then apply it to your database.
To create the migration, execute:
wrangler d1 migrations create
This will create an SQL file in a migrations folder where you can then go ahead and add your queries. Then apply the migrations to your database by executing:
wrangler d1 migrations apply
Access D1 from within your Worker
You can attach your D1 to a Worker by adding the D1 binding to your wrangler.toml configuration file. Then interact with D1 by executing queries inside your Worker like so:
export default {
async fetch(request, env) {
const { pathname } = new URL(request.url);
if (pathname === "/api/beverages") {
const { results } = await env.DB.prepare(
"SELECT * FROM Customers WHERE CompanyName = ?"
)
.bind("Bs Beverages")
.all();
return Response.json(results);
}
return new Response("Call /api/beverages to see Bs Beverages customers");
},
};
Or access D1 from within your Pages Function
In this Alpha launch, D1 also supports integration with Cloudflare Pages! You can add a D1 binding inside the Pages dashboard, and write your queries inside a Pages Function to build a full-stack application! Check out the full documentation to get started with Pages and D1.
Community built tooling
During our private alpha period, the excitement behind D1 led to some valuable contributions to the D1 ecosystem and developer experience by members of the community. Here are some of our favorite projects to date:
d1-orm
An Object Relational Mapping (ORM) is a way for you to query and manipulate data by using JavaScript. Created by a Cloudflare Discord Community Champion, the d1-orm seeks to provide a strictly typed experience while using D1:
const users = new Model(
// table name, primary keys, indexes etc
tableDefinition,
// column types, default values, nullable etc
columnDefinitions
)
// TS helper for typed queries
type User = Infer;
// ORM-style query builder
const user = await users.First({
where: {
id: 1,
},
});
This is a zero-dependency query builder that provides a simple standardized interface while keeping the benefits and speed of using raw queries over a traditional ORM. While not intended to provide ORM-like functionality, workers-qb makes it easier to interact with the database from code for direct SQL access:
Instead of running the wrangler d1 execute command in your terminal every time you want to interact with your database, you can interact with D1 from within the d1-console. Created by a Discord Community Champion, this gives the benefit of executing multi-line queries, obtaining command history, and viewing a cleanly formatted table output.
While this is a community project today, we plan to natively support a “D1 Console” in the future. For now, get started by checking out the d1-console package here.
Kysely is a type-safe and autocompletion-friendly typescript SQL query builder. With this adapter you can interact with D1 with the familiar Kysely interface:
// Create Kysely instance with kysely-d1
const db = new Kysely({
dialect: new D1Dialect({ database: env.DB })
});
// Read row from D1 table
const result = await db
.selectFrom('kv')
.selectAll()
.where('key', '=', key)
.executeTakeFirst();
The biggest pieces that have been disabled for this alpha release are replication and JavaScript transaction support. While we’ll be rolling out these changes gradually, we want to call out some limitations that exist today that we’re actively working on testing:
Database location: Each D1 database only runs a single instance. It’s created close to where you, as the developer, create the database, and does not currently move regions based on access patterns. Workers running elsewhere in the world will see higher latency as a result.
Concurrency limitations: Under high load, read and write queries may be queued rather than triggering new replicas to be created. As a result, the performance & throughput characteristics of the open alpha won’t be representative of the final product.
Availability limitations: Backups will block access to the DB while they’re running. In most cases this should only be a second or two, and any requests that arrive during the backup will be queued.
You can also check out a more detailed, up-to-date list on D1 alpha Limitations.
Request for feedback
While we can make all sorts of guesses and bets on the kind of databases you want to use D1 for, we are not the users – you are! We want developers from all backgrounds to preview the D1 tech at its early stages, and let us know where we need to improve to make it suitable for your production apps.
For general feedback about your experience and to interact with other folks in the alpha, join our #d1-open-alpha channel in the Cloudflare Developers Discord. We plan to make any important announcements and changes in this channel as well as on our monthly community calls.
To file more specific feature requests (no matter how wacky) and report any bugs, create a thread in the Cloudflare Community forum under the D1 category. We will be maintaining this forum as a way to plan for the months ahead!
Get started
Want to get started right away? Check out our D1 documentation to get started today. Build our classic Northwind Traders demo to explore the D1 experience and deploy your first D1 database!
The difference between HTTP and HTTPS can be the difference between your business being successful or suffering a data breach. Let’s quickly highlight the key differences you should know about these two foundational connection types
HTTP, or hypertext transfer protocol, is the default connection type that websites revert to without a special security tool called an SSL/TLS certificate. See that padlock near the top of your browser window? That means you’re using HTTPS, which is a secure connection (hence, the “S” at the end). If you don’t see one, it means you’re using an insecure (unprotected) connection that leaves your data vulnerable. (In a nutshell, that’s the difference between HTTP vs HTTPS.)
Unless you like handing out your most sensitive data like it’s Halloween candy, you’ll want to ensure you’re using HTTPS for all of your website connections.
But aside from adding an extra letter at the end of the acronym, what is the difference between HTTP and HTTPS? Don’t worry, we’ll cover everything you need to know in just a few moments.
Let’s hash it out.
A 2-Minute Overview of HTTP vs HTTPS and Their Differences
HTTP and HTTPS are both internet connection protocols — meaning they’re sets of rules that govern how you transmit data remotely between parties. (For example, between your website and the customers who connect to it.)
The difference between the two boils down to data security: One secures data in transit (HTTPS) using verified identity and public key cryptography while the other does not (HTTP). This means that while data is transmitting via HTTP, it’s vulnerable to interception attacks (i.e., man-in-the-middle attacks). HTTPS is basically HTTP with a little something “extra.”
HTTPS = HTTP + Transport Layer Security (TLS)
TLS is the successor of SSL, which you’ve likely heard of, and requires a site owner to install a special digital certificate called an SSL/TLS certificate (AKA a website security certificate). TLS combines verified digital identity and encryption with the traditional HTTP request and response messages to make them more secure. This way, any unintended users can’t intercept and read those messages in transit.
We won’t get into all of the technical nitty-gritty of how HTTPS works here — there’s not enough time for that in this article. Instead, take a look at the following illustration to see the difference between HTTP and HTTPS when it comes to securing website connections:
Image caption: A set of diagrams that display the difference between HTTP and HTTPS to secure data in transit.
Here’s a quick-glance guide that highlights the differences of HTTP vs HTTPS:
Type of Protocol
HTTP
HTTPS
What It Is (Technical Definition)
Hypertext transport protocol — this is a set of rules for transmitting data in plaintext.
Hypertext transport protocol secure — this set of rules teams encryption with verified digital identity to encrypt data in transit. This means your data is secure against unauthorized access.
Simplified Definition
An HTTP connection is like sending a postcard that’s open for everyone to see and is susceptible to unauthorized modifications.
An HTTPS connection is like sending a coded (enciphered) message that only you have the key for, and that’s sealed in a envelope with a wax stamp to protect the integrity of the message.
Requests and Responses
Request and response data for your website is not encrypted.
Uses transport layer security (TLS), formerly secure sockets layer (SSL), to encrypt data to secure data in transit.
Port Number(s)
Port 80
Port 443
How to Enable It
Doesn’t require anything special; this is the default communication protocol for data transfers. This is what servers revert to when secure connections fail, or website security certificates aren’t installed on the server.
Requires installing an SSL/TLS certificate on your server that contains verified info about your domain and organization.
How You Know It’s Enabled
Security icons display in your browser’s address bar to indicate your website connection isn’t secure (icons vary by browser): A padlock icon with a line marked through An exclamation markA padlock with an exclamation mark and “HTTPS” crossed out with strikethrough text You’ll also see “http://” at the beginning of the website’s URL. (This may require you to click on the URL to get it to display.)
A locked padlock icon that communicates that the website (or, more accurately, its connection) is secure. You’ll see “https://” display in the web address bar as well. (This may require you to click on the URL first to get it to appear.)
Security Risks
Vulnerable to man-in-the-middle (MitM) attacks that enable cybercriminals to intercept your communications and steal, manipulate or delete your data in transit.
The recommended security mechanism to protect your data in transit against MitM attacks and other related security issues.
Performance Speeds
HTTP is faster than HTTPS, but the difference is negligible and doesn’t outweigh the security benefits of the latter.
HTTPS is slower but more secure than HTTP. However, HTTP/2, which compresses data and supports multiplexing, is faster and requires the use of HTTPS.
Why You Should Use HTTPS Instead of HTTP
When users visit websites loading via HTTP, they’ll see “Not Secure” messages that caution proceeding any further. As you can imagine, these warnings can have negative effects on your reputation and relationship with customers. After all, why should they trust you when you’re making no visible effort to keep their data secure? They shouldn’t, and rightfully so. This is why you need to step up and do something about it to make your website more secure.
Before the internet, you physically had to meet up with someone to securely exchange data. (Think of clandestine meetups in classic spy movies). Otherwise, you’d risk a message being intercepted where someone could make unauthorized changes to its contents, and you’d never know the difference.
In an age of near-instantaneous communications, these time-consuming and expensive rendezvous are no longer necessary. Public key encryption, which is at the core of what makes HTTPS possible, enables people the world over to engage in secure remote communications.
Enabling HTTPS on your website is a smart move for several key reasons:
Resolves the security issues plaguing HTTP requests and responses
Requires the verification of your site’s digital identity
Gets rid of the ugly “Not Sure” and “Insecure Website” warnings that drive away customers
How HTTP & HTTPS Sites Display in Your Browser (Chrome, Firefox, and Microsoft Edge)
Look at the web address bar in the Google Chrome browser: Is there a locked padlock icon displaying? How about an “https://” displaying in the URL itself when you click on it? If you answer yes to either (or both) of these questions, great! This means you’re using a secure, encrypted connection.
Image caption: A screenshot example of a secure website that’s using an HTTPS connection. This is demonstrated through the inclusion of the security padlock icon to the left of the website URL.
If your answer is no because you’re not seeing a locked padlock in Chrome but are seeing an exclamation point (or a padlock with an exclamation point), it means the website is using HTTP and isn’t secure:
Image caption: A screenshot of an insecure (HTTP) website as it displays in Google Chrome. This exclamation point is meant to catch the user’s attention and warn them that the website is insecure.Image caption: A look at how Google Chrome displays HTTP error messages (in this case, how an expired SSL/TLS certificate displays).
Unsurprisingly, browsers like to put their own spins on things. Mozilla’s Firefox browser takes a slightly different approach, displaying the padlock with a red line through it in the address bar:
Image caption: A screenshot of a website that’s loaded via an insecure (HTTP) connection on Firefox. The same concept applies here as with Chrome — only this time, it uses a red slash to indicate the website’s insecurity.
Similar to Google Chrome, Microsoft’s Edge browser also wants it to be obvious that you’re using an insecure website. They use virtually the same UI with a combination of colored exclamation points and strikethrough text to catch your attention — they just don’t use as much red as Chrome for SSL/TLS related error messages. For example, check out this screenshot from an example insecure website:
Image caption: A screenshot of a website loaded via an insecure (HTTP) connection in the Microsoft Edge browser. This is like the love child of Chrome and Firefox’s warning indicators: It has the exclamation and “Not Secure” message like Chrome but the red coloration like the slash mark in Firefox.
Final Thoughts on HTTP vs HTTPS Differences
It’s easy to see why enabling HTTPS on your website is a no-brainer. While HTTP is technically faster in terms of performance, that gets blown out of the water when you consider the security advantages that its more secure counterpart offers. HTTPS pairs verified digital identity with encryption to ensure that only the right party is able to access your secure data. HTTPS clearly wins the “HTTP vs HTTPS” battle.
In the overwhelming majority of situations, there’s no excuse for using an insecure HTTP connection for your website. The few-and-far-between exceptions would be websites where no sensitive information is requested or shared by site users (i.e., informational websites, but even then there may be an admin login URL). If your organization has an ecommerce store, lets users log in, or otherwise collects sensitive data, then you’d better secure your website ASAP with HTTPS.
Any delay further leaves your (and your customers’) data open to theft, modification, and other issues.
Whether you’re a software creator or sales manager, digital signatures are essential to the security and authenticity of your data. Here are several of the ways that you can use digital signature certificates to enhance trust in your organization
We live in a world where you really have to question everything: is this email from your boss legitimate? Is the software update you want to install authentic, or is it a trojan that’s waiting to infect your device? When you log in to your favorite eCommerce website, how do you know it’s legitimate?
A digital signature certificate could hold the answer in all of these cases. These tiny data files help your web or email client verify that the file or other party you’re connecting to is trustworthy and authentic. This way, you don’t inadvertently share your sensitive login information or other data with cybercriminals.
But how can you use digital signature certificates to your advantage? We’ll go over all of that in just a few moments. But first, we think it would benefit our newer readers to briefly recap what a digital signature is and why you need a digital signature certificate to create it.
Note: If you’re already well acquainted with digital signatures and digital signature certificates, jump ahead to our list of digital signature certificate use cases.
What Is a Digital Signature? A Quick Recap
Digital signatures, also called public key signatures, are a cryptographic method of showing who created a digital asset and ensuring the item hasn’t been changed by another party. Examples of such assets include emails, PDFs, Word files, software application codes, etc. Applications frequently use visual marks of some kind (e.g., a ribbon mark in Microsoft Outlook) to represent digital signatures.
These signatures are trusted because you need to have a special file called a digital signature certificate in order to sign them digitally. But before you can get this digital certificate, a publicly trusted third party (called a certificate authority or CA) has to carefully vet your identity. Once you receive and start using your digital signature certificate, it proves that whatever you sign is authentic because it was created and signed by you, and your identity has been validated.
Digital signatures are a type of electronic signature. But unlike regular electronic signatures, which generally look similar to handwritten signatures, digital signatures might not look anything like traditional signatures. Here are a few quick examples to showcase the difference between electronic and digital signatures:
Image caption: A visual comparison that shows the difference between some of the visual indicators that may display for an electronic signature (left) and a digital signature (right).
How Digital Signatures Are Created
To create a digital signature, you first need to have a digital certificate in hand. A digital certificate is a small data file that contains verified, identifying information about you or your organization. (This is the main info that displays to users.) But that’s not all that’s required. Without getting too technical, digital signatures are created by applying two cryptographic tools to the data you wish to protect:
A special cryptographic function (called a hash function or hash algorithm) — This creates a hash value (a mishmash of letters and characters) of a fixed length, which masks the true size of the input and ensures the integrity of the data.
A private key, which encrypts the hash value — When the recipient receives or downloads the file, they can decrypt it using the signer’s public key. This key ensures only the intended user can read the data.
Digital Signatures Enable You to Prove You and Your Files Are Legitimate
A digital signature validates your identity to other parties and ties it to whatever you’ve created and signed. The important takeaway here is that digital signatures offer two key qualities that you won’t find in regular electronic signatures:
Authentication — This means you can prove that you or something you created is legitimate.
Non-Repudiation — This ensures recipients that you, and only you, created or signed the item in question; that an imposter didn’t fraudulently make it.
Historically, if you wanted to prove that you’re the legitimate signer of a document, you’d have to meet up with a public notary to have them observe you signing it. This process required providing the notary with verifiable proof of identity — this is typically some form of ID from a trusted entity (i.e., your driver’s license or ID issued by your state or country’s government).
This is fine if you’re physically located in the same area where it’s easy to meet up to carry out this process. But what if you’re trying to do business with someone in another country? Meeting up face-to-face then becomes a lot more complicated and costly.
So, where do you find digital signatures? All over the place, honestly. You’ll find digital signatures used in everything from website connections to document signing.
You Need a Digital Signature Certificate to Use Your Digital Signature
Digital signatures are typically stored in special files known as digital certificates. For the sake of this article, we’ll call them digital signature certificates. Digital signature certificates are small digital files that enable you to use those signatures online.
A few examples of these digital signature certificates include:
Of course, there’s another type of digital certificate that uses digital signatures: an SSL/TLS certificate. This file is what enables you to prove that your website is legitimate because it’s been signed off on by a trusted CA (like DigiCert or Sectigo). But we’ll talk more about that in a little bit.
Okay, now that we have all of that out of the way, let’s jump right to what you need to know about how you can use each of these digital signature certificates…
5 Digital Signature Certificate Use Cases For Your Business
For virtually all of our readers, you’re likely already using digital signature certificates in one way or another (you just might not know it). However, there may be some use cases that you’re not as familiar with or aren’t sure how to implement within your IT environment. We’re here to explore those and more:
1. You Need a Way to Show Your Microsoft Office and PDF Files Are Authentic
Image caption: A screenshot of how the digital signature information displays in a digitally signed Microsoft Word document.
Nowadays, you practically can’t do anything within your business without using Word, Excel, or PDF files. Of course, you’d like to assume that someone will send you only legitimate files via email. However, the reality isn’t as pretty. While it may be true, say, 90% of the time, the remaining percentage is enough to crack those rose-colored glasses.
As recent cyber security statistics and cyber crime statistics show, the threat landscape continues to change. New threat actors seemingly arrive on the scene almost daily and attack methods evolve with them. For example, SonicWall reports the prevalence of malicious Microsoft Office files decreased 64% in 2021; malicious PDFs, on the other hand, increased 52%.
So, how can you show users that your documents and files are legitimate? Digitally sign them first using a document signing certificate. For example, this is what it looks like when you sign a Word document using a document signing certificate:
Here’s what it looks like when you sign an Adobe PDF file with an applicable digital signature certificate:
Image caption: A screenshot of how a digital signature’s information displays in a digitally signed Adobe PDF file.
2. You Want to Eliminate Warning Messages When Users Download Your Software
SonicWall’s 2022 Cyber Threat Report data shows that malicious executables represented a whopping 30.27% of the cybersecurity company’s malicious file detections. As such, as a software developer or publisher, you need to have a way to show that:
Your software is authentic,
It’s actually from you, and
No one’s modified it.
You can do this using a code signing certificate. These certificates are typically offered with two options of validation levels: organizational (i.e., standard) and extended. (Note: Some certificate authorities offer individual validation as well.) When you use this type of digital signature certificate to sign your software, you attach your organization’s verified information to the file regardless of the validation type you choose.
Image caption: A set of screenshots that show the difference between how files display when they’re digitally signed (right) and are not digitally signed (left). A digital signature certificate lets you display your verified publisher name on the installation prompt screen.
Both types of certificates are trusted automatically by browsers and operating systems. The big difference between the two validation levels is that Windows Defender SmartScreen requires an EV certificate if you don’t want an ugly warning message to pop up:
Image caption: A screenshot of the warning message that Windows Defender SmartScreen displays when you try to install unsigned software.
3. You Want to Give Customers and Prospects a Reason to Trust Your Website
Trust is hard to earn yet fragile as glass. Once you earn your customers’ trust, you need to do everything possible to protect it. Having a way to prove that your website — your brand’s digital representation — is legitimate is essential to that mission.
Every time you visit your favorite website, the server sends your browser a file (i.e., an SSL/TLS certificate) containing crucial identifying data that proves you’re connecting to the right server. This website security certificate is issued and digitally signed by a publicly trusted entity known as a certificate authority (CA). The CA’s trusted root
Image caption: A screenshot of the certificate authority’s chain of trust, which showcases the digital signatures of each certificate that signs the next to attest to its authenticity.
The CA’s digital signature means that this globally trusted entity is vouching for you, saying that you’ve, essentially, been vetted and are trusted. Having such a way to prove your organization’s authenticity is particularly crucial when you consider recent data from Bolster shows that their systems detected nearly 10.7 million phishing and scam pages in 2021 alone. To put this in more relatable terms, it means Bolster’s team detected an average of 29,190 fraudulent pages every day throughout the year.
Want your authentic website to stand out from the sea of fraudsters’ sites? Then slap your vetted and validated identity on it by installing an SSL/TLS certificate right away. In addition to asserting your digital identity, SSL/TLS certificates enable users to communicate securely with your site. If you install an extended validation (EV) code signing certificate, then you take your digital identity to another level by displaying your verified company information upfront. This way, users don’t have to dig around your certificate info to find the details.
Image caption: A screenshot of the verified company information for TheSSLstore.com.
4. You Need to Prove to Recipients That Your Email Communications Are Authentic
Phishing is one of the top cyber attack methods used by cybercriminals. Verizon’s 2022 Data Breach Investigations Report (DBIR) data shows that email is one of the two leading attack vectors used in known data breaches. Furthermore, their report indicates that 75% of the malware the median organization received in 2021 came via email.
Sure, you can — and should — train your employees to recognize the threats associated with phishing attacks and social engineering. But it doesn’t hurt to add another more technical layer of security to the equation; this is where digital signature certificates for email come into play.
These certificates are known as email signing certificates or S/MIME (single/multi-purpose internet mail extension) certificates. They allow you to attach your digital signature to messages so your recipients can confirm they came from you. These certificates offer the added benefit of enabling you to encrypt your emails as well. This helps to provide end-to-end encryption by securing the emails before they leave your email server.
Here’s a quick look at what a digitally signed email looks like to your recipient:
Image caption: The screenshot above shows both the verified “signed by” information and the ribbon icon that indicate I’d digitally signed and sent the email to one of my colleagues.
5. You Want to Authenticate Without the Risks Associated with Traditional Passwords
There’s no such thing as a perfect authentication method; an enterprising cybercriminal will inevitably find a way to authenticate as you (fraudulently) if they’re truly motivated. But the goal is to make yourself as difficult a target as possible; this way, 99% of cybercriminals will give up and move on to the next target. Make yourself one of the hardest-to-reach fruits on the tree instead of one of the easy-to-steal, low-hanging fruits.
This is where a type of digital signature certificate, known as a client authentication certificate, can come in handy. A client authentication certificate enables you to authenticate without having to type in a username or password. Instead, you have a PKI certificate installed on your device, enabling you to authenticate automatically.
Why is this necessary? ForgeRock reports that 50% of cyber attacks they studied were due to unauthorized access through various account compromises. Of course, there are many ways accounts can become compromised. One of the most common methods is phishing, which involves an attacker stealing a user’s login information using social engineering tactics.
Using PKI-based authentication instead of a username-password combination means you no longer have a password that can be phished or stolen via malware. You simply go to the web app or system you have permission to access, and the authentication “magic” happens on the backend automatically. No muss, no fuss.
Image caption: An example of a client authentication certificate. This type of digital signature certificate enables a user to authenticate automatically without using traditional login credentials.
Final Takeaways on Digital Signature Certificates
It’s now more important than ever to secure your organization’s digital identity and data. Choosing to use a digital signature certificate to secure your digital assets is the difference between sending or receiving authenticated communications or files instead of unauthenticated (and potentially dangerous) ones.
To get a digital signature certificate for your website, emails, documents, or software:
Evaluate what you need to secure and authenticate.
Go to your favorite CA or authorized reseller’s website.
Choose the certificate(s) based on the type(s) of coverage and validation type.
Purchase your certificate(s).
Generate a certificate signing request (CSR) for domain validation (DV) and organization validation (OV) certificates, if applicable.
Provide the CA with the necessary organizational information to complete validation.
Collect your digital signature certificate and install it on your server, device, or client.
Brand impersonation attacks hit companies ranging from small businesses to giants like Microsoft and Facebook. Explore what these types of attacks are and how you can protect your organization and customers
What do Microsoft, Facebook, and Crédit Agricole all have in common? Sure, they’re all big-name companies, but something else they share is that their brands are the three most commonly used in brand impersonation scams. These cyber attack scams involve someone pretending to be your company.
It’s said that imitation is the sincerest form of flattery, but that doesn’t hold true with brand impersonations. In these scenarios, bad guys use your name and reputation to swindle customers out of their login credentials, other sensitive data, and hard-earned money. But it may surprise you to know that your company isn’t a target in this situation. The target (i.e., the victim in this case) is the customer or other potential user who receives the deceptive communications and falls for it. Your company is simply a means to an end to help bad guys reach their true goals.
As you can imagine, mass brand impersonations result in significant costs and lost trust for those affected brands. The Federal Trade Commission (FTC) reports that the reported costs of business and government impersonation scams increased 85% year over year, bringing total losses from October 2020 to September 2021 to a whopping $2 billion! (This doesn’t include costs of impersonation scams that have gone unreported — and who knows how many of those have gone on that the FTC just doesn’t know about!)
But what exactly is brand impersonation? And, more importantly, how can you use digital identity to protect your brand and customers against these types of cyber attacks?
Let’s hash it out.
What Is Brand Impersonation? A Look at Brand Spoofing
Brand impersonation, or brand spoofing, is a phishing tactic that involves cybercriminals falsely representing themselves as your organization or one of its employees. This is typically done to get people (e.g., your customers or other users) to believe they’re interacting with your company. This way, they’ll be more willing to share their personal or otherwise sensitive information.
You know those fake Walmart or Amazon emails you always get in your junk mail? Yeah, those are just two examples of the types of mass brand impersonation you’ll commonly see nowadays. The idea is to get you to click on a link that takes you to a fake login portal where you’ll be prompted to provide sensitive information such as your username and password. Since this phony site is controlled by the attacker, they’ll be able to steal your login credentials or other information easily.
Brand impersonation attacks are often a shotgun “spray and pray” approach wherein an attacker sends out mass emails to a bunch of people with the hope that at least a few will fall for them. Bad guys ride the coattails of the trust your company has established with customers to trick them into doing one or all of the following:
Logging into a fake account portal that enables the attacker to steal their login credentials
Making payments for fraudulent products or services
Providing other desired sensitive information
Installing malware onto their devices
But what do some of these brand impersonation emails look like? In truth, you’ve probably already received some and just didn’t know it. Let’s take a quick look at a couple of brand impersonation scam emails I’ve received in the past few months.
A Look at Real-World Brand Impersonation Scams
I frequently receive fake Norton LifeLock and Microsoft emails — almost daily, in fact. Suppose I was a legitimate Norton LifeLock customer and wasn’t paying attention to the sender’s email address. In that case, I might not notice that an email came from an unrelated domain. As a result, I might wind up handing my username, social security number, or other sensitive information over to a cybercriminal on a silver platter.
Here are a few examples of Norton LifeLock phishing emails I’ve received:
Image caption: A side-by-side screenshot of three Norton LifeLock scam emails I’ve received.
Look at all of the different invoice numbers and amounts, ranging from $214 to $463. Notice that the emails are all sent to me using the BCC field instead of including me as the only email contact. All of these factors, coupled with the fact that the senders’ email addresses have nothing to do with Norton and the messages are super generic, help me recognize that these emails have “phishing” written all over them.
Common Brand Impersonation Scams and Attack Vectors
Brand impersonation attacks can occur in many ways. Attackers often create emails, text messages, social media profiles, and/or websites that look like they’re from a legitimate brand to win the trust of their targets.
A few of the most common organization or brand impersonation scams you’ll find include:
Tech support scams — These scams often involve an attacker coercing a victim into downloading malicious software onto their devices under the false premise that their device is infected with malware. FBI data shows that 23,903 tech support fraud complaints were received in 2021 with losses surpassing $347 million.
Vendor scams — Not all targets are consumers. In some cases, attackers will impersonate one business in order to target another. In these cases, cybercriminals will create fake invoices that they send via email to trick the target organization’s employees into clicking on it and installing malware. Sometimes, they’ll go as far as to create fake websites and domains that closely resemble the real organization’s website to trick the victim into visiting it.
Subscription scams — Here, attackers convince unsuspecting users that they’ve been charged for services or products. To get a refund, they must call a call center or download some type of software. (Think of the Norton LifeLock scam we talked about earlier.)
Law enforcement scams — Bad guys have no shame. Many cybercriminals have no qualms about pretending to be someone at your local police station or even impersonating a federal agent. Here, they’ll threaten targets with fines or even prison if they don’t comply with their demands.
Job offer/recruitment scams — Yes, truly, nothing is sacred. Whether you’re unemployed or are just looking for a new position, beware of fake job recruiters. These are among the lowest-of-the-low scammers who prey on individuals; they make false promises of great jobs to lure them into sharing sensitive information.
4 Methods of Brand Impersonation Attacks (and How to Tell They’re Scams)
Let’s explore a few examples of the most common ways cybercriminals carry out these attacks:
1. Email Mass Brand Impersonation Attacks
This is a favorite approach for many cybercriminals because emails are cheap, quick, and easy to send. But what makes them particularly attractive is that they can simultaneously use these electronic messages to target many potential users. Cybercriminals can send out emails from domains that look similar to yours to trick users into providing info, opening malicious attachments, or going to phishing or malicious websites. This approach doesn’t require that they have access to your account (such as in an account takeover [ATO] attack — more on that in a second).
Let’s consider the following example of a brand spoofing email I received that was targeting American Airlines customers:
Image caption: A screenshot of an American Airlines phishing scam email I’d received.
Overall, this phishing email is pretty well put together. The grammar is pretty good, the graphics look official, and the display of “American Airlines” as the sender is a nice touch. However, if you dig a little deeper, you’ll start to notice a few key points that give away this is a spam email.
First, let’s start with what the sender’s email address actually looks like when you go beyond the surface:
Image caption: An up-close screenshot that showcases the sender’s non-American Airlines email address.
Next, let’s look at the URL that the OK button is trying to direct me to:
Image caption: An up-close screenshot that showcases the non-American Airlines URL that the button tried to direct me to click on.
Let’s consider another example that, in some ways, is a little trickier. It comes from what appears to be a legitimate email account and domain. This may have been a case of an account takeover attack, which means that an attacker gained access to a legitimate email account and used it to send out phishing or malicious messages.
Image caption: A screenshot of an email I received containing a fraudulent (and potentially malicious) PDF attachment.
The first glaring issue here is that I don’t do business with this organization, nor am I one of their patients. Second, let’s take a closer look at a link that was embedded in the View Attachments button:
This link would take you to an unknown website URL that is designed to appear to come from Adobe. But not everything is as it appears; when I checked this link against VirusTotal’s search tool, the search result shows that it’s flagged as malicious:
Image caption: A screenshot of the URL checking results of the suspicious emailed link.
Yup, it’s always a good idea to do a secondary check before clicking on any unknown (and unsolicited) links. Clicking on this link opens you up to the risk of getting malware onto your device or going to a phony login portal that can steal your username and password.
2. Brand Impersonation Phone Calls
Cybercriminals use voice phishing (vishing) to carry out attacks. In this case, bad guys use phones (often with the help of automated dialers) or VoIP systems to call people while pretending to be well-known companies or organizations. Some common examples of vishing scams involve personating the following companies or agencies:
Technology companies,
Financial institutions, and
Law enforcement and other federal agencies (such as the FBI or IRS).
Bad guys know that fear is a big motivating factor. This is why some threat actors love to use scare tactics to coerce or manipulate victims into doing something they normally wouldn’t (like handing over account information or other sensitive info).
3. Brand Impersonation SMS Text Message Scams
A screenshot of a phishing SMS text message (smishing message) impersonating Walmart.
SMS phishing, or smishing, is an approach cybercriminals use to drive targets to phishing or malicious websites. They send SMS text messages containing links to websites (under the guise of enticing surveys, sweepstakes, or free gift card offers) to random or targeted users’ phone numbers to see who will bite. An example of such a text message is the screenshot displayed to the right.
The goal here is to trick victims into believing that the messages are legitimate. This way, they’ll be more likely to click on the link in the message, which can lead to a fake login portal or a site with drive-by downloaders.
4. Some Cybercriminals Combine Multiple Phishing Methods
Some brand impersonation attacks involve a combination of different attack methods. For example, I’ve received Microsoft subscription scam emails wherein the attacker says I’ve been charged for a phony recurring subscription. To cancel it or get a refund for the charges, I’m prompted to call a phone number where they can walk me through downloading a remote desktop protocol (RDP) application that will give them access to my device.
The attackers use the excuse that I need to download the program to connect to their bank server to initiate a money transfer to my account for reimbursement. Of course, the truth is that the whole situation is utter nonsense: there is no refund, as the charge wasn’t real.
The attacker’s goal is to get me to give them remote admin access to my device so they can:
Install malware,
Steal my information,
Encrypt my files, or
Do other nefarious things.
Needless to say, if I fall for even one of these scams, it’s bad news for me and will likely result in a payday for the attacker.
Mass Brand Impersonation Enables Cybercriminals to Capitalize on Your Reputation
If you’re like most organizations, you’ve worked long and hard to establish your business. You’ve probably spent many long days, nights, and weekends trying to win over customers and prove your value as a reputable organization they can trust. All your hard work goes out the window when someone hijacks your good name and uses it to cause harm through mass brand impersonation attacks and scams.
Attackers use phishing and other social engineering tactics to make their phony emails, text messages, and/or emails appear legitimate. To help prevent some of the usual attack vectors and help strengthen your brand against these types of attacks, it’s crucial that you take steps to secure your digital identity.
What Is Digital Identity and Where Does It Come Into Play?
Your digital identity is what helps people know you’re really you in the digital world. It’s a combination of various verifiable identifying data that offers assurance to others that you or your organization is legitimate and not an imposter.
An easy-to-recognize example of digital identity is an organization validation (OV) or extended validation (EV) SSL/TLS certificate. This digital certificate file ties key organizational information to your domain — verifiable information such as your common name and locality information — and is a key component of public key infrastructure (PKI), which we’ll speak to in just a few moments.
When you install an EV SSL/TLS certificate on your web server, it communicates to users’ browsers that your website is legitimate and displays your verified organizational information upfront. Here’s a quick example of how that looks on our website:
Image caption: A screenshot of The SSL Store’s EV SSL/TLS certificate.
How to Protect Your Digital Identity Against Use In Brand Impersonation Scams
Now that we know what mass brand impersonation is and why it’s such a problem, there’s only one big thing left to talk about now: what you can do to prevent these impersonation attacks from affecting your organization.
Public key infrastructure (PKI) — essentially, the backbone of internet security — relies on the use of PKI digital certificates. These certificates come in multiple varieties and serve different purposes. Here are some of the ways that you can protect your brand online using PKI and other methods.
Secure Your Domain with an EV SSL/TLS Certificate
Installing an extended validation (EV) SSL/TLS certificate ensures you’re asserting your digital identity in the biggest way possible. An EV certificate ensures your company’s verified name displays as prominently as possible while also including more detailed organizational information in your certificate details.
You may also want to consider registering domains that closely resemble yours and install redirects to your main site to keep cybercriminals from registering those domains and doing anything bad in your name.
Use Email Signing Certificates to Add Your Signature to Outbound Emails
Much like how monarchs and others throughout history used wax seals to authenticate their correspondences and ensure their integrity, you can use a special digital certificate (called an email signing certificate) to do the same with your emails.
Digitally signing your emails is the modern solution to an age-old problem of communicating securely with someone when you’re physically not in the same location. Using a cryptographic signature provides a way for your email recipients to verify that your messages are authentic and haven’t been altered.
Protect Your Domain Against Unauthorized Usage by Setting Up DNS Records
Show Customers Your Emails Are Legitimate Before They Even Click on Them with BIMI & VMCs
Implementing brand indicators of message identification (BIMI) in combination with using verified mark certificates (VMCs) adds another layer of digital identity to your outbound emails. This allows you to brand your mail right in recipients’ inboxes. This way, recipients know your emails are legitimate just by looking at your verified logo next to your messages in their inbox.
Apple and Google support using BIMI and VMCs to display your verified logo in emails received by users on their respective platforms.
Assert Your Digital Identity in Your Code to Secure Your Software & Supply Chain
If you’re a developer or publisher, this is for you. Digitally signing your software, patches, scripts, and other executables using a code signing certificate enables you to prove their authenticity to browsers and operating systems. This process attaches your verifiable digital signature to your code using cryptographic functions showing that your products haven’t been altered since they were originally signed.
Doing this assures your users that your software is legitimate and hasn’t been modified without your knowledge.
Of course, it’s important to note that these certificates won’t stop attackers from simply claiming to be you and delivering unsigned code. However, what they do is provide users with a way of determining whether your communications, website, or software are legitimate. This way, if they download software or receive an email from “your company” (i.e., an attacker) that’s not digitally signed or doesn’t contain your verified logo, it’ll give them a reason to pause.
Train Your Employees to Recognize Authentic Company Communications
Educating and training your employees about cybersecurity is crucial for helping them keep your organization safe. If your employees have no clue as to how to identify a legitimate email from an imposter’s fake one, then you might as well post a sign out front stating, “cybercriminals — make yourselves at home.”
As part of the training you provide, you’ll want to educate your employees to recognize and decipher your legitimate communications quickly and easily. This way, they can quickly assess messages to figure out whether they’re authentic. A well-known example of a company that takes this approach is PayPal:
Dedicates an entire section of their website to educating users
Sends out emails regularly to their users, warning about scams and providing examples of emails to avoid
Displays other messages to educate users of the dangers of brand impersonation and other phishing scams
Monitor Your Brand Online
Your work isn’t done yet. Another crucial step in preventing brand impersonation (or, at least, mitigating its impact) is keeping an eye on your brand name online. Look out for instances of how and where it’s being used and referenced by other parties. You can even set up Google Alerts to inform you any time someone publishes something relating to specific keywords or key phrases you enter — for example, your company’s name.
We’re going to leave you with one final but important thought. For you to put your digital identity to use in an effective (and secure) way, you must properly manage your PKI certificate keys, passwords, and other “secrets.” If you don’t carefully manage your access information and even just one of them gets lost or stolen, you risk exposing your sensitive data and systems or someone signing things they shouldn’t in the name of your company.
Either way, the scenario will likely result in damage to your brand and reputation, fines, or maybe even lawsuits down the road. It’s just bad news all the way around with no upside.
We’ve dived head-first into Devolution’s latest report (State of Cybersecurity in SMBs 2022-2023) on cybersecurity for small and mid-size businesses so you don’t have to. Here’s are the five key highlights you need to know from this new study…
Cybersecurity is an important investment for all businesses and organizations, regardless of size. As someone at a small or mid-size business, you may think that small businesses are less-tempting targets for cybercriminals — but the opposite is actually true. For example, Barracuda reports that companies with fewer than 100 employees are 350% more likely to suffer social engineering attacks than their enterprise counterparts.
Since SMBs make appealing targets for cybercriminals (especially since they make up 99.9% of all businesses in the U.S.), it’s crucial to stay abreast of the latest industry data. This can be hard, though, when you’re trying to run or operate a smaller business. This is why we want to help by sharing some of the latest data in one short(ish) article.
Devolutions released its third consecutive State of Cybersecurity in SMBs 2022-2023 report. This year’s latest research, which was released Oct. 11, highlights that 60% of small and mid-size businesses experienced one or more cyberattacks over the last year:
One-in-four (42%) indicate that they’ve faced upwards of five attacks in the last year
Almost one-fifth (18%) experienced five or more attacks within the same period
We’ve picked the five most relevant data points from Devolutions’ SMB research that we think will be of interest to our readers. Be sure to check out the Devolutions website to read the full report.
Let’s hash it out.
Top Takeaway: SMBs Rank Ransomware as Their Biggest Cybersecurity Threat
81% of Devolutions’ survey respondents view ransomware as their businesses’ biggest security threat. This is followed by phishing (69%) and other types of malware (38%). In some aspects, it’s no surprise because ransomware is a major threat because it often results in the encryption or destruction of victims’ data (even when the victims pay the demanded ransom). In some cases, ransomware attacks are multi-pronged because attackers also attack victims’ data backups to cause additional damage or demand a second ransom payment.
However, I honestly figured #1 and #2 would have been reversed, particularly considering that many ransomware attacks often involve the use of phishing, as do other cybersecurity concerns. But, hey, everyone is different and has different security priorities and concerns.
Takeaway #2: Nearly One-Third of Businesses Earmark <5% of IT Budget to Security
A disturbing statistic from Devolution’s report that really stuck out to me is that 32% of small and mid-size businesses dedicate less than one-twentieth (1/20) of their IT budget to IT security. Now, consider that Connectwise reports that 69% of their survey respondents admit they’re concerned one bad cyber attack could permanently force them to close their doors. Knowing this concern and being aware that nearly one-third of organizations dedicate only 5% of their overall IT budgets to security sends the message that companies aren’t putting in much of an effort to prevent such an attack from happening.
What really drives home the dismal nature of that number is when you consider that CompTIA reports the average small business only devotes $5,000-$249,000 of their overall budget to IT each year to begin with (the “sweet spot” for SMBs ranges between $10,000 and $49,000). This means that only 5% of already potentially limited budgets is what companies are using to fund their IT security initiatives. Yikes.
Let’s take a closer look at this for a little more perspective. Imagine that your company invests $45,000 in your IT budget each year. This means that if you’re one of the 32% of SMBs that dedicate only 5% of your IT budget to IT security, then it means you’re spending just $2,250 a year to secure your organization against cyber attacks and threats. That means your cybersecurity is worth just $6.25 per day to your business — or the equivalent of a large pumpkin spice latte at a specific major coffee shop chain.
It truly is astonishing that some businesses treat IT security as the ugly, redheaded stepchild. Considering that all it takes is one cybersecurity “oops” for everything to go wrong, IT security should be ranked as one of the essential elements of your IT environment. It doesn’t matter how many new and shiny devices you have… if you don’t bother dedicating the time, money, and resources needed to keep those devices and network secure, then they won’t do you any good.
But there is some good news here: Devolutions recommends SMBs allocate between 6% and 15% of the IT budget to IT security (which includes cybersecurity). We’re happy to relay that the majority of SMB respondents (68%) fall within this range. But in a perfect world, we’d definitely prefer to see higher average IT security spending.
Takeaway #3: By and Large, Organizations Want to Increase Their IT Budget Spending
Now, let’s see what organizations are doing in terms of increasing or decreasing their IT security budgets. 49% report that they’re spending more this year on IT security than they did last year. Awesome. But this stat is tempered when you consider that 51% indicate that their budgets either decreased (6%) or remained unchanged (45%) from the previous year.
However, there is a bit of good news here. 94% of survey respondents indicate that they either plan to spend the same amount (48%) or increase their spending (46%) in the next 12 months. Of course, we’d prefer to see the higher number in the “we-want-to-increase-our-spending-on-IT-security” budget category, but I guess we’ll take the wins where we can.
There’s also one very important consideration to keep in mind when it comes to budgets and IT security spending: every organization is different and each one allocates different amounts to begin with. So, some companies may start out with a higher amount (closer to the $249,000 end of the range mentioned earlier) and need to increase it less each year while others may have a much smaller budget (like the $5,000 end of the range) and need more significant investments.
Takeaway #4: Organizations Are Starting to See the Light Regarding Password Security
Passwords are the keys to the kingdoms of most small and mid-size organizations. These are the secrets that provide access to user accounts and give access to everything from banking and finance accounts to employees’ personal records data. Comparitech, citing LastPass data, shows that small business employees are the biggest offenders when it comes to demonstrating poor password security: “Those working for companies with 1-25 staff reuse passwords an average of 14 times.”
Yeah, definitely not good. So, it makes sense that one of the sections of the Devolutions report highlights 18 security projects that respondents wanted to take on in the next 12 months… more than one-third of which relate to password or account security:
Introducing or fully integrating two-factor authentication (2FA)
Implementing automatic password rotation
Expanding a password management tool for use by all employees (not just IT staff)
Hardening Active Directory
Implementing more granular and just-in-time access to resources
Shifting to passwordless authentication
Of course, using secure passwords (or implementing PKI-based client authentication) isn’t all you can or should be doing to secure access within your organization. Additional steps you can take include:
Maintaining current user profile and permissions lists
Implement the principle of least privilege within your IT environment (i.e., only give access to those who need it to do their jobs)
Requiring users to use secure, encrypted connections when connecting to websites
Educating employees on the importance of account security and best practices
Storing only salted and peppered password hashes in lieu of plaintext passwords
Setting authentication rate limits
Monitoring traffic to your network, services, and applications
Blocking access to internal resources from IPs outside your company’s geographic region
Takeaway #5: 56% of SMBs Are Content to Maintain IT Security Staffing Status Quo
Our final data point from the Devolutions report focuses more on the employees themselves:
38% of the survey respondents indicated that their organizations brought new employees on board since the start of the global COVID-19 pandemic (i.e., early 2020) to address IT security needs and concerns.
Another 6% say they’re working with external service providers to achieve the same.
The remaining 56% of respondents indicate that they’ve not hired any new cyber or IT security-related employees since early 2020.
Not bringing new employees into the fold isn’t necessarily bad news. Yes, on the one hand, it could mean that they don’t want to fork out the funds to hire new people and skills. But on the other hand, it may mean that they already have the right people and skills in place, so they don’t need to hire anyone else. (Less likely, but definitely still a possibility.)
Unfortunately, the former is the most likely scenario. Another recent survey from Cobalt (The State of Pentesting 2022) shows that nearly all of their 602 respondents indicate that they’re affected by staffing and talent shortages. Regardless of the cause of the shortages (whether they don’t hire enough people or employees leave), labor shortages ultimately lead to many security issues for the organization and team members who remain.
Final Takeaway on Cybersecurity for Small and Mid-Size Businesses
We hope this article has been enlightening and given you greater insights into investing in cybersecurity as a small or mid-size business. Whether you have just a handful of employees or 100, every person, application, and device that exists within your IT environment represents a potential attack surface that cybercriminals can target.
Having strong IT and cybersecurity is not just crucial to preventing cyber attacks, but they’re also compliance requirements for notable standards like the EU’s General Data Protection Regulation (GDPR), the U.S.’s Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry’s Data Security Standards (PCI DSS).
